I'm super impressed that they got it to work so quickly. What I hate about crypto is that is either wrong or right, there is no "mostly working" that you can identify easily and use as a debugging aid.
This drove me crazy when I was working on kTLS in FreeBSD. When I worked on other features (like getting checksum offload right in NIC firmware) there were easy tricks I could use for debugging, like sending a stream of all zeros. For crypto, it was basically back to first principals and code examination..
TLS 1.3 has some published test vectors where if you understand the inputs (which is tricky) and do the same operations, you'll end up with the same outputs as the test vectors and that should maybe work with a real server too.
Still, it helps a ton to get error logs (or step through debugging) from a real server to figure out what you messed up. For every value you send in a TLS handshake, it feels like you've got to send the length three different times, in different numbers of bytes and sometimes adding the bytes it takes to send the length.
But, if you can smash through all that, you can get a reasonably working TLS 1.3 client in about a week of fiddling. If your runtime has a decent api to validate certificates, you can call out to that too (the less you personally do with x.509, the better)
Comments
I'm super impressed that they got it to work so quickly. What I hate about crypto is that is either wrong or right, there is no "mostly working" that you can identify easily and use as a debugging aid.
This drove me crazy when I was working on kTLS in FreeBSD. When I worked on other features (like getting checksum offload right in NIC firmware) there were easy tricks I could use for debugging, like sending a stream of all zeros. For crypto, it was basically back to first principals and code examination..
TLS 1.3 has some published test vectors where if you understand the inputs (which is tricky) and do the same operations, you'll end up with the same outputs as the test vectors and that should maybe work with a real server too.
Still, it helps a ton to get error logs (or step through debugging) from a real server to figure out what you messed up. For every value you send in a TLS handshake, it feels like you've got to send the length three different times, in different numbers of bytes and sometimes adding the bytes it takes to send the length.
But, if you can smash through all that, you can get a reasonably working TLS 1.3 client in about a week of fiddling. If your runtime has a decent api to validate certificates, you can call out to that too (the less you personally do with x.509, the better)
Edit: link to vectors https://datatracker.ietf.org/doc/rfc8448/
Agreed, I second that recommendation for anyone interested in this stuff to write a toy TLS implementation. Here's mine: https://github.com/syncsynchalt/tincan-tls
Nice, I didn't know that. I did most of the work in ~2017 before TLS 1.3.