Detailed Description

TLS 1.3 server handshake state machine for QUIC (RFC 9001 / RFC 8446).

Drives the server side of the TLS 1.3 handshake that QUIC carries in CRYPTO frames. It ties the key schedule (tls13_kdf), the handshake messages (tls13_msg), and the transport parameters (quic_tp) together: it runs the transcript hash, consumes the client's ClientHello, produces the server flight (ServerHello at the Initial level; EncryptedExtensions + Certificate + CertificateVerify + Finished at the Handshake level), derives the Handshake and 1-RTT packet keys for both directions, and verifies the client's Finished.

The transport engine (quic_conn) owns CRYPTO stream reassembly and packet protection; this module is transport-free. It consumes an in-order byte run (quic_tls_recv_crypto returns how many bytes it used) and exposes the outbound flight per encryption level (quic_tls_flight), so it is fully host-testable by feeding it a captured ClientHello and inspecting the flight and derived keys.

Profile: TLS_AES_128_GCM_SHA256, X25519, Ed25519 certificate, no PSK / 0-RTT / HelloRetryRequest / client authentication. The ephemeral X25519 private key and the ServerHello random are supplied in the config (the caller draws them from its RNG, or fixes them in a test).

Author: Douglas Quigg (dstroy0)

Date: 2026

Definition in file quic_tls.h.