Detailed Description

TLS 1.3 handshake messages for the QUIC handshake (RFC 8446 sec 4).

The wire formats of the handshake messages a QUIC server exchanges: it parses the client's ClientHello and builds its own flight (ServerHello, then the encrypted EncryptedExtensions, Certificate, CertificateVerify, and Finished). Every message is emitted whole, including the 4-byte handshake header (msg_type + 24-bit length), because that is what both the CRYPTO stream carries and the transcript hash covers.

This server is deliberately a single, spec-valid profile: cipher suite TLS_AES_128_GCM_SHA256, key share X25519, and an Ed25519 certificate (the only signature scheme we produce - the in-tree crypto has Ed25519 but no ECDSA P-256 or RSA-PSS). A ClientHello that offers none of these is a handshake failure, decided by the state machine that drives this module. QUIC transport parameters ride in the quic_transport_parameters extension (codepoint 0x39, RFC 9001 sec 8.2).

Pure, zero heap, host-tested against the RFC 8448 sec 3 ServerHello / Certificate / Finished bytes and by ClientHello field extraction + an Ed25519 CertificateVerify sign/verify round-trip.

Author: Douglas Quigg (dstroy0)

Date: 2026

Definition in file tls13_msg.h.