1
key_shares = {
2
    "x25519": generate_x25519_keypair(),    # 优先级最高
3
    "secp256r1": generate_ec_keypair("P-256"),  # 备选
4
}

1
客户端                                    服务器
2
------                                    ------
3
生成私钥 a（随机标量）                    生成私钥 b（随机标量）
4
计算公钥 A = a * G                        计算公钥 B = b * G
5
                                          （G 是曲线基点）
6

7
发送 A ──────────────────────────────────→
8
                    ←────────────────────── 发送 B
9

10
计算共享密钥：                              计算共享密钥：
11
shared = a * B                             shared = b * A
12
       = a * (b * G)                              = b * (a * G)
13
       = (a * b) * G                              = (a * b) * G
14
       ↑ 两者相等 ↑
15

16
前向安全保证：
17
- a 和 b 是临时生成的，用完即弃
18
- 即使长期私钥泄露，也无法反推 shared
19
- 每次连接的 shared 都不同

1
攻击场景：0-RTT 重放攻击
2

3
1. 客户端发送 0-RTT 请求：
4
   PUT /api/transfer HTTP/1.1
5
   Authorization: Bearer token_xxx
6
   { "to": "attacker", "amount": 1000 }
7

8
2. 攻击者截获该请求
9

10
3. 攻击者原封不动地重放（可能多次）：
11
   → 服务器收到相同的 PUT 请求
12
   → 服务器处理了多次转账
13
   → 客户端被转走 N × 1000 元
14

15
关键问题：
16
- 0-RTT 数据没有 Server Random 参与
17
- 服务器无法区分"新请求"和"重放请求"
18
- TCP 层的重放防御对应用层无效

1
HKDF-Expand-Label(Secret, Label, Context, Length) =
2
    HKDF-Expand(Secret, HkdfLabel, Length)
3

4
其中 HkdfLabel 的结构：
5
struct {
6
    uint16 length = Length;
7
    opaque label<7..255> = "tls13 " + Label;
8
    opaque context<0..255> = Context;
9
} HkdfLabel;
10

11
示例：派生客户端握手密钥
12
HKDF-Expand-Label(
13
    handshake_secret,
14
    "c hs traffic",        // label
15
    Transcript-Hash(CH),   // context = ClientHello 的哈希
16
    32                      // length
17
) → client_handshake_traffic_secret

1
import hmac
2
import hashlib
3
def hkdf_extract(salt: bytes, ikm: bytes) -> bytes:
4
    """HKDF-Extract: HMAC(salt, IKM)"""
5
    return hmac.new(salt, ikm, hashlib.sha256).digest()
6
def hkdf_expand_label(secret: bytes, label: str, context: bytes, length: int) -> bytes:
7
    """HKDF-Expand-Label（简化版）"""
8
    hkdf_label = length.to_bytes(2, 'big')
9
    label_bytes = b"tls13 " + label.encode()
10
    hkdf_label += len(label_bytes).to_bytes(1, 'big') + label_bytes
11
    hkdf_label += len(context).to_bytes(1, 'big') + context
12
    return hkdf_expand(secret, hkdf_label, length)
13
def hkdf_expand(prk: bytes, info: bytes, length: int) -> bytes:
14
    """HKDF-Expand"""
15
    n = (length + 31) // 32
16
    okm = b""
17
    t = b""
18
    for i in range(1, n + 1):
19
        t = hmac.new(prk, t + info + i.to_bytes(1, 'big'), hashlib.sha256).digest()
20
        okm += t
21
    return okm[:length]
22
shared_secret = ecdhe_compute_key(client_private, server_public)
23
early_secret = hkdf_extract(b'\x00' * 32, b'\x00' * 32)
24
handshake_secret = hkdf_extract(early_secret, shared_secret)
25
client_hs_traffic = hkdf_expand_label(handshake_secret, "c hs traffic", transcript_hash_ch, 32)
26
server_hs_traffic = hkdf_expand_label(handshake_secret, "s hs traffic", transcript_hash_ch, 32)
27
client_hs_key = hkdf_expand_label(client_hs_traffic, "key", b"", 16)   # AES-128
28
client_hs_iv  = hkdf_expand_label(client_hs_traffic, "iv",  b"", 12)   # GCM IV
29
server_hs_key = hkdf_expand_label(server_hs_traffic, "key", b"", 16)
30
server_hs_iv  = hkdf_expand_label(server_hs_traffic, "iv",  b"", 12)
31
master_secret = hkdf_extract(handshake_secret, b'\x00' * 32)
32
client_app_traffic = hkdf_expand_label(master_secret, "c ap traffic", transcript_hash_all, 32)
33
server_app_traffic = hkdf_expand_label(master_secret, "s ap traffic", transcript_hash_all, 32)
34
client_app_key = hkdf_expand_label(client_app_traffic, "key", b"", 16)
35
client_app_iv  = hkdf_expand_label(client_app_traffic, "iv",  b"", 12)
36
server_app_key = hkdf_expand_label(server_app_traffic, "key", b"", 16)
37
server_app_iv  = hkdf_expand_label(server_app_traffic, "iv",  b"", 12)

1
export SSLKEYLOGFILE=/tmp/sslkeys.log
2

3
sudo tshark -i eth0 -f "tcp port 443" -w /tmp/tls13-capture.pcap &
4

5
curl -v --tls13-ciphers TLS_AES_256_GCM_SHA384 https://example.com
6

7
tshark -r /tmp/tls13-capture.pcap -Y "tls.handshake" -T fields \
8
  -e frame.number \
9
  -e ip.src \
10
  -e ip.dst \
11
  -e tls.handshake.type \
12
  -e tls.handshake.version

1
head -3 /tmp/sslkeys.log

1
PSK_KE_ONLY = 0     # 仅 PSK，无前向安全（不推荐）
2
PSK_DHE_KE   = 1     # PSK + DHE，有前向安全（推荐）
3

4
psk_key_exchange_modes = [PSK_DHE_KE]  # 只接受 PSK + DHE

1
server {
2
    listen 443 ssl http2;
3
    server_name example.com;
4
    ssl_protocols TLSv1.2 TLSv1.3;
5
    ssl_ciphers TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256;
6
    ssl_prefer_server_ciphers on;
7
    ssl_certificate /etc/ssl/certs/server.crt;
8
    ssl_certificate_key /etc/ssl/private/server.key;
9
    ssl_stapling on;
10
    ssl_stapling_verify on;
11
    ssl_trusted_certificate /etc/ssl/certs/chain.pem;
12
    resolver 8.8.8.8 8.8.4.4 valid=300s;
13
    ssl_session_timeout 1d;
14
    ssl_session_cache shared:SSL:50m;
15
    ssl_session_tickets on;
16
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
17
    add_header X-Content-Type-Options "nosniff" always;
18
    add_header X-Frame-Options "SAMEORIGIN" always;
19
}

1
<VirtualHost *:443>
2
    ServerName example.com
3

4
    SSLEngine on
5
    SSLProtocol -all +TLSv1.2 +TLSv1.3
6

7
    SSLCipherSuite TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
8

9
    SSLCipherSuite SSL ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
10

11
    SSLCertificateFile /etc/ssl/certs/server.crt
12
    SSLCertificateKeyFile /etc/ssl/private/server.key
13
    SSLCertificateChainFile /etc/ssl/certs/chain.pem
14

15
    # HSTS
16
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
17

18
    # OCSP Stapling
19
    SSLUseStapling on
20
    SSLStaplingCache shmcb:/var/run/ocsp(128000)
21
</VirtualHost>

1
package main
2
import (
3
    "crypto/tls"
4
    "net/http"
5
)
6
func main() {
7
    // TLS 1.3 配置
8
    tlsConfig := &tls.Config{
9
        MinVersion: tls.VersionTLS12,
10
        CurvePreferences: []tls.CurveID{
11
            tls.X25519,       // 优先 X25519
12
            tls.CurveP256,    // 备选 P-256
13
        },
14
        CipherSuites: []uint16{
15
            tls.TLS_CHACHA20_POLY1305_SHA256,
16
            tls.TLS_AES_256_GCM_SHA384,
17
            tls.TLS_AES_128_GCM_SHA256,
18
        },
19
    }
20
    server := &http.Server{
21
        Addr:      ":443",
22
        TLSConfig: tlsConfig,
23
    }
24
    // Go 1.21+ 默认启用 TLS 1.3
25
    server.ListenAndServeTLS("server.crt", "server.key")
26
}

1
// Java: TLS 1.3 配置（JDK 11+）
2
import javax.net.ssl.SSLContext;
3
import java.net.ServerSocket;
4
import java.net.Socket;
5
public class TLSServer {
6
    public static void main(String[] args) throws Exception {
7
        // 启用 TLS 1.3
8
        SSLContext sslContext = SSLContext.getInstance("TLSv1.3");
9
        sslContext.init(null, null, null);
10
        // 创建 SSL ServerSocket
11
        ServerSocket serverSocket = sslContext
12
            .getServerSocketFactory()
13
            .createServerSocket(443);
14
        // JDK 11+ 默认支持 TLS 1.3
15
        // 可通过系统属性控制：
16
        // jdk.tls.client.protocols=TLSv1.3
17
        // jdk.tls.server.protocols=TLSv1.3
18
        while (true) {
19
            Socket client = serverSocket.accept();
20
            // 处理连接...
21
        }
22
    }
23
}

1
openssl s_client -connect github.com:443 -servername github.com -tls1_3 </dev/null

1
CONNECTED(00000003)
2
---
3
Certificate chain
4
 0 s:CN = github.com
5
   i:C = GB, O = Sectigo Limited, CN = Sectigo Public Server Authentication CA DV E36
6
   a:PKEY: id-ecPublicKey, 256 (bit); sigalg: ecdsa-with-SHA256
7
   v:NotBefore: May  5 00:00:00 2026 GMT; NotAfter: Aug  2 23:59:59 2026 GMT
8
 1 s:C = GB, O = Sectigo Limited, CN = Sectigo Public Server Authentication CA DV E36
9
   i:C = GB, O = Sectigo Limited, CN = Sectigo Public Server Authentication Root E46
10
   a:PKEY: id-ecPublicKey, 256 (bit); sigalg: ecdsa-with-SHA384
11
   v:NotBefore: Mar 22 00:00:00 2021 GMT; NotAfter: Mar 21 23:59:59 2036 GMT
12
 2 s:C = GB, O = Sectigo Limited, CN = Sectigo Public Server Authentication Root E46
13
   i:C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust ECC Certification Authority
14
   a:PKEY: id-ecPublicKey, 384 (bit); sigalg: ecdsa-with-SHA384
15
   v:NotBefore: Mar 22 00:00:00 2021 GMT; NotAfter: Jan 18 23:59:59 2038 GMT
16
---
17
...
18
Peer signing digest: SHA256
19
Peer signature type: ECDSA
20
Server Temp Key: X25519, 253 bits
21
---
22
SSL handshake has read 3126 bytes and written 373 bytes
23
Verification: OK
24
---
25
New, TLSv1.3, Cipher is TLS_AES_128_GCM_SHA256
26
Server public key is 256 bit
27
Secure Renegotiation IS NOT supported
28
Compression: NONE
29
Expansion: NONE
30
No ALPN negotiated
31
Early data was not sent
32
Verify return code: 0 (ok)
33
---
34
DONE

1
openssl s_client -connect github.com:443 -servername github.com -tls1_2 </dev/null

1
...
2
Peer signing digest: SHA256
3
Peer signature type: ECDSA
4
Server Temp Key: X25519, 253 bits
5
---
6
SSL handshake has read 3030 bytes and written 365 bytes
7
Verification: OK
8
---
9
New, TLSv1.2, Cipher is ECDHE-ECDSA-AES128-GCM-SHA256
10
Server public key is 256 bit
11
Secure Renegotiation IS supported
12
Compression: NONE
13
Expansion: NONE
14
No ALPN negotiated
15
SSL-Session:
16
    Protocol  : TLSv1.2
17
    Cipher    : ECDHE-ECDSA-AES128-GCM-SHA256
18
    Session-ID:
19
    Session-ID-ctx:
20
    Master-Key: F23AA9C594D9E89CDDCE5EC174C31A9F...
21
    PSK identity: None
22
    PSK identity hint: None
23
    SRP username: None
24
    Start Time: 1778164040
25
    Timeout   : 7200 (sec)
26
    Verify return code: 0 (ok)
27
    Extended master secret: yes
28
---
29
DONE