Types
CipherSuite = enum csAesGcm128 = 51, csAesGcm256 = 52, csAesCcm128 = 53, csChacha20Poly1305 = 54, csSm4Gcm = 55, csSm4Ccm = 56, csAriaGcm128 = 57, csAriaGcm256 = 58
KeyMaterial = object version*: TlsVersion cipher*: CipherSuite key*: seq[byte] iv*: seq[byte] salt*: seq[byte] recSeq*: array[8, byte] ## Record sequence number (big-endian on the wire). Starts at zero ## for a fresh epoch and increments per record; for TLS 1.3 ## KeyUpdate re-arming, carry over the next expected sequence.
- Validated key material for one direction. Build with initKeyMaterial, install with session.setTx/session.setRx.
TlsVersion = enum tv12 = 771, ## TLS 1.2 (`0x0303`). tv13 = 772 ## TLS 1.3 (`0x0304`).
Procs
proc cipherType(km: KeyMaterial): uint16 {....raises: [], tags: [], forbids: [].}
proc initKeyMaterial(cipher: CipherSuite; version: TlsVersion; key, iv, salt: openArray[byte]; recSeq: array[8, byte] = [0'u8, 0, 0, 0, 0, 0, 0, 0]): KeyMaterial {. ...raises: [KtlsError], tags: [], forbids: [].}
- Build validated KeyMaterial, raising KtlsError on length mismatch. The kernel additionally requires ARIA suites to use TLS 1.2 (enforced here so the failure surfaces before any syscall).
proc ivLen(c: CipherSuite): Natural {....raises: [], tags: [], forbids: [].}
proc keyLen(c: CipherSuite): Natural {....raises: [], tags: [], forbids: [].}
proc saltLen(c: CipherSuite): Natural {....raises: [], tags: [], forbids: [].}
proc versionNumber(km: KeyMaterial): uint16 {....raises: [], tags: [], forbids: [].}