#TLS握手流程深度解析

# ClientHello 消息内容
client_hello = {
    "tls_version": "TLS 1.2",          # 支持的最高TLS版本
    "client_random": random(32),       # 32字节随机数
    "cipher_suites": [                  # 支持的加密套件列表
        "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
        "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
        "TLS_RSA_WITH_AES_256_GCM_SHA384",
        # ... 更多套件
    ],
    "extensions": {
        "sni": "www.example.com",       # 服务器名称指示
        "alpn": ["h2", "http/1.1"],    # 协议协商
        "status_request": True          # OCSP stapling
    }
}

# ServerHello 消息内容
server_hello = {
    "tls_version": "TLS 1.2",          # 协商后的版本
    "server_random": random(32),        # 服务器随机数
    "cipher_suite": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
    # 选择了第一个双方都支持的ECDHE套件
}

# Certificate 消息
certificate_chain = [
    server_certificate,    # 服务器证书（包含公钥）
    intermediate_ca,      # 中间证书
    # ... 可能有多级中间证书
]

# 客户端密钥生成
client_key_exchange = {
    # ECDHE密钥交换
    "client_ecdhe_params": {
        "curve": "secp256r1",          # 使用的椭圆曲线
        "public_key": G * d_client,    # 客户端公钥
    }
}

# 密钥计算
premaster_secret = ecdh_shared_secret(
    client_private_key,
    server_public_key
)

master_secret = PRF(
    premaster_secret,
    "master secret",
    client_random + server_random
)

# 生成会话密钥
session_keys = {
    "client_write_mac_key": ...,        # 客户端消息认证
    "server_write_mac_key": ...,        # 服务器消息认证
    "client_write_key": ...,           # 客户端加密密钥
    "server_write_key": ...,           # 服务器加密密钥
    "client_write_iv": ...,            # 客户端IV
    "server_write_iv": ...             # 服务器IV
}

# ECDHE（Elliptic Curve Diffie-Hellman Ephemeral）
# 双方各自生成临时密钥对

# 客户端：
client_private = random_scalar()           # 随机私钥
client_public = G * client_private          # 公钥 = 基点 * 私钥

# 服务器：
server_private = random_scalar()           # 随机私钥
server_public = G * server_private         # 公钥

# 共享密钥（双方独立计算，结果相同）：
# 客户端计算：server_public * client_private
# 服务器计算：client_public * server_private
# 数学上：(G * s) * c = G * (s * c) = G * (c * s) = (G * c) * s

shared_secret = client_public * server_private

# Finished 消息
finished = {
    "verify_data": PRF(
        master_secret,
        "client finished",
        hash(all_handshake_messages)
    )
}

# 双方验证：
# 1. 解密对方的 Finished 消息
# 2. 用握手消息的哈希验证是否被篡改
# 3. 如果验证通过，说明握手成功

# TLS 1.3 只支持5个加密套件
TLS1.3_AES_128_GCM_SHA256         # AES-128-GCM + SHA-256
TLS1.3_AES_256_GCM_SHA384         # AES-256-GCM + SHA-384
TLS1.3_CHACHA20_POLY1305_SHA256   # ChaCha20-Poly1305 + SHA-256
TLS1.3_AES_128_CCM_SHA256         # AES-128-CCM + SHA-256
TLS1.3_AES_128_CCM_8_SHA256      # AES-128-CCM-8 + SHA-256

# TLS 1.3 密钥派生（更简洁）
derived_secrets = HKDF-Extract(
    ecdh_shared_secret,
    transcript_hash(ClientHello, ServerHello)
)

# 早期数据密钥（0-RTT）
early_data_key = Derive-Secret(derived_secrets, "client early traffic secret")

# 握手密钥（用于加密Server Certificate）
handshake_key = Derive-Secret(derived_secrets, "handshake traffic secret")

# 主密钥（用于加密应用数据）
application_key = Derive-Secret(
    HKDF-Expand-Label(master_secret, "derived", transcript_hash()),
    "application traffic secret"
)

def verify_certificate(cert_chain):
    # 1. 提取证书链
    server_cert = cert_chain[0]
    intermediates = cert_chain[1:]
    
    # 2. 找到可信根证书
    root_ca = find_trusted_root(server_cert.subject)
    
    # 3. 构建完整链并验证
    # 中间证书1 → 中间证书2 → ... → 根证书
    verify_chain(intermediates + [server_cert], root_ca)
    
    # 4. 检查证书吊销
    for cert in cert_chain:
        if is_revoked(cert):
            raise CertificateRevokedError()
    
    # 5. 检查时间有效性
    if not (cert.valid_from <= now <= cert.valid_to):
        raise CertificateExpiredError()
    
    # 6. 检查域名匹配
    if not domain_matches(server_cert, target_domain):
        raise DomainMismatchError()
    
    return True

def domain_matches(cert, hostname):
    """
    浏览器检查证书是否匹配域名
    """
    # 1. 检查Subject Alternative Names (SAN)
    for san in cert.san:
        if san.type == DNS_NAME:
            if match_dns_pattern(san.value, hostname):
                return True
        if san.type == IP_ADDRESS:
            if san.value == hostname:
                return True
    
    # 2. 降级到Common Name（已废弃）
    if cert.cn == hostname:
        return True
    
    return False

def match_dns_pattern(pattern, hostname):
    """
    支持通配符：*.example.com 匹配 www.example.com
    但 *.com 不匹配 www.com
    * 不能匹配有多个label的域名
    """
    if pattern.startswith('*.'):
        suffix = pattern[2:]
        return hostname.endswith(suffix) and hostname.count('.') >= suffix.count('.') + 1
    return pattern == hostname

# Session Resumption：复用之前的master_secret
# 不需要完整的密钥交换

# 方式1：Session ID
client_hello = {
    "session_id": "上次会话ID"
}
# 服务器返回相同的session_id，跳过密钥交换
# 直接用之前协商的密钥

# 方式2：Session Ticket（PSK）
client_hello = {
    "psk": "上次会话的ticket"
}
# 0-RTT可能，实现更简单

# 服务器提前获取OCSP响应
ocsp_response = server.fetch_ocsp_from_ca()

# TLS握手时附带OCSP响应
server_hello = {
    "certificate": server_cert,
    "certificate_status": {
        "type": "ocsp",
        "response": ocsp_response
    }
}
# 浏览器不需要额外查询OCSP服务器