pierrelf.com / we
we (web engine): Experimental web browser project to understand the limits of Claude
Star
Fork 0
Watch

Fix app key derivation: use transcript hash through server Finished master

The application traffic secrets (RFC 8446 §7.1) must be derived from the transcript hash covering ClientHello...server Finished, not including the client Finished message. The code was using transcript.current_hash() after updating with client_finished_msg, producing incorrect application keys that would fail against real servers. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author Pierre Le Fevre Co-author Claude Opus 4.6 Date Commit 2b37ef89 Parent 79b113a8
+3 -1
1 changed file