From 2b37ef89b0912819beb27d2fbfeafb1d44121926 Mon Sep 17 00:00:00 2001
From: Pierre Le Fevre <hello@pierrelf.com>
Date: Thu, 12 Mar 2026 20:34:47 +0100
Subject: [PATCH] Fix app key derivation: use transcript hash through server
 Finished
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The application traffic secrets (RFC 8446 §7.1) must be derived from
the transcript hash covering ClientHello...server Finished, not
including the client Finished message. The code was using
transcript.current_hash() after updating with client_finished_msg,
producing incorrect application keys that would fail against real
servers.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 crates/net/src/tls/handshake.rs | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/crates/net/src/tls/handshake.rs b/crates/net/src/tls/handshake.rs
index b35d72b..0772057 100644
--- a/crates/net/src/tls/handshake.rs
+++ b/crates/net/src/tls/handshake.rs
@@ -786,7 +786,9 @@ pub fn connect<S: Read + Write>(stream: S, server_name: &str) -> Result<TlsStrea
     transcript.update(&client_finished_msg);
 
     // Step 10: Derive application keys
-    key_schedule.derive_app_secrets(&transcript.current_hash());
+    // RFC 8446 §7.1: application traffic secrets use the transcript hash through
+    // server Finished (client_finished_hash), NOT including client Finished.
+    key_schedule.derive_app_secrets(&client_finished_hash);
 
     let client_app_keys = key_schedule.client_app_keys();
     let client_app_iv: [u8; 12] = client_app_keys.iv.try_into().expect("IV must be 12 bytes");
-- 
2.51.2