bctls-fips-1.0.2 Base class for a TLS client. an of (or null). The default implementation calls this to determine which named groups to include in the supported_groups extension for the ClientHello. The named group roles for which there should be at least one supported group. By default this is inferred from the offered cipher suites and signature algorithms. an of . See for group constants. Base class for supporting a TLS key exchange implementation. Base class for supporting a TLS key exchange factory implementation. Base class for a TLS client or server. Get the values that are supported by this peer. WARNING: Mixing DTLS and TLS versions in the returned array is currently NOT supported. Use a separate (sub-)class for each case. an array of supported values. Base class for a TLS server. RFC 5246 7.2. This message notifies the recipient that the sender will not send any more messages on this connection. Note that as of TLS 1.1, failure to properly close a connection no longer requires that a session not be resumed. This is a change from TLS 1.0 ("The session becomes unresumable if any connection is terminated without proper close_notify messages with level equal to warning.") to conform with widespread implementation practice. An inappropriate message was received. This alert is always fatal and should never be observed in communication between proper implementations. This alert is returned if a record is received with an incorrect MAC. This alert also MUST be returned if an alert is sent because a TLSCiphertext decrypted in an invalid way: either it wasn't an even multiple of the block length, or its padding values, when checked, weren't correct. This message is always fatal and should never be observed in communication between proper implementations (except when messages were corrupted in the network). This alert was used in some earlier versions of TLS, and may have permitted certain attacks against the CBC mode [CBCATT]. It MUST NOT be sent by compliant implementations. A TLSCiphertext record was received that had a length more than 2^14+2048 bytes, or a record decrypted to a TLSCompressed record with more than 2^14+1024 bytes. This message is always fatal and should never be observed in communication between proper implementations (except when messages were corrupted in the network). The decompression function received improper input (e.g., data that would expand to excessive length). This message is always fatal and should never be observed in communication between proper implementations. Reception of a handshake_failure alert message indicates that the sender was unable to negotiate an acceptable set of security parameters given the options available. This is a fatal error. This alert was used in SSLv3 but not any version of TLS. It MUST NOT be sent by compliant implementations. A certificate was corrupt, contained signatures that did not verify correctly, etc. A certificate was of an unsupported type. A certificate was revoked by its signer. A certificate has expired or is not currently valid. Some other (unspecified) issue arose in processing the certificate, rendering it unacceptable. A field in the handshake was out of range or inconsistent with other fields. This message is always fatal. A valid certificate chain or partial chain was received, but the certificate was not accepted because the CA certificate could not be located or couldn't be matched with a known, trusted CA. This message is always fatal. A valid certificate was received, but when access control was applied, the sender decided not to proceed with negotiation. This message is always fatal. A message could not be decoded because some field was out of the specified range or the length of the message was incorrect. This message is always fatal and should never be observed in communication between proper implementations (except when messages were corrupted in the network). A handshake cryptographic operation failed, including being unable to correctly verify a signature or validate a Finished message. This message is always fatal. This alert was used in some earlier versions of TLS. It MUST NOT be sent by compliant implementations. The protocol version the client has attempted to negotiate is recognized but not supported. (For example, old protocol versions might be avoided for security reasons.) This message is always fatal. Returned instead of handshake_failure when a negotiation has failed specifically because the server requires ciphers more secure than those supported by the client. This message is always fatal. An internal error unrelated to the peer or the correctness of the protocol (such as a memory allocation failure) makes it impossible to continue. This message is always fatal. This handshake is being canceled for some reason unrelated to a protocol failure. If the user cancels an operation after the handshake is complete, just closing the connection by sending a close_notify is more appropriate. This alert should be followed by a close_notify. This message is generally a warning. Sent by the client in response to a hello request or by the server in response to a client hello after initial handshaking. Either of these would normally lead to renegotiation; when that is not appropriate, the recipient should respond with this alert. At that point, the original requester can decide whether to proceed with the connection. One case where this would be appropriate is where a server has spawned a process to satisfy a request; the process might receive security parameters (key length, authentication, etc.) at startup, and it might be difficult to communicate changes to these parameters after that point. This message is always a warning. Sent by clients that receive an extended server hello containing an extension that they did not put in the corresponding client hello. This message is always fatal. This alert is sent by servers who are unable to retrieve a certificate chain from the URL supplied by the client(see Section 3.3). This message MAY be fatal - for example if client authentication is required by the server for the handshake to continue and the server is unable to retrieve the certificate chain, it may send a fatal alert. This alert is sent by servers that receive a server_name extension request, but do not recognize the server name. This message MAY be fatal. This alert is sent by clients that receive an invalid certificate status response (see Section 3.6 ). This message is always fatal. This alert is sent by servers when a certificate hash does not match a client provided certificate_hash. This message is always fatal. If the server does not recognize the PSK identity, it MAY respond with an "unknown_psk_identity" alert message. In the event that the server supports no protocols that the client advertises, then the server SHALL respond with a fatal "no_application_protocol" alert. If TLS_FALLBACK_SCSV appears in ClientHello.cipher_suites and the highest protocol version supported by the server is higher than the version indicated in ClientHello.client_version, the server MUST respond with a fatal inappropriate_fallback alert[..]. Sent by endpoints that receive a handshake message not containing an extension that is mandatory to send for the offered TLS version or other negotiated parameters. Sent by servers when a client certificate is desired but none was provided by the client. RFC 5246 7.2 A basic PSK Identity holder. A queue for bytes. This file could be more optimized. The smallest number which can be written as 2^x which is bigger than i. The buffer where we store our data. How many bytes at the beginning of the buffer are skipped. How many bytes in the buffer are valid data. Add some data to our buffer. A byte-array to read data from. How many bytes to skip at the beginning of the array. How many bytes to read from the array. The number of bytes which are available in this buffer. Copy some bytes from the beginning of the data to the provided . The to copy the bytes to. How many bytes to copy. Read data from the buffer. The buffer where the read data will be copied to. How many bytes to skip at the beginning of buf. How many bytes to read at all. How many bytes from our data to skip. Return a over some bytes at the beginning of the data. How many bytes will be readable. A over the data. Remove some bytes from our data from the beginning. How many bytes to remove. Remove data from the buffer. The buffer where the removed data will be copied to. How many bytes to skip at the beginning of buf. How many bytes to read at all. How many bytes from our data to skip. OutputStream based on a ByteQueue implementation. Implementation of the RFC 3546 3.3. CertChainType. Parsing and encoding of a Certificate struct from RFC 4346. 
            opaque ASN.1Cert<2^24-1>;
            struct {
              ASN.1Cert certificate_list<0..2^24-1>;
            } Certificate;
an array of representing a certificate chain. true if this certificate chain contains no certificates, or false otherwise. Encode this to a , and optionally calculate the "end point hash" (per RFC 5929's tls-server-end-point binding). the of the current connection. the to encode to. the to write the "end point hash" to (or null). Parse a from a . the to apply during parsing. the of the current connection. the to parse from. the to write the "end point hash" to (or null). a object. RFC 8879 Parsing and encoding of a CertificateRequest struct from RFC 4346. 
            struct {
              ClientCertificateType certificate_types<1..2^8-1>;
              DistinguishedName certificate_authorities<3..2^16-1>;
            } CertificateRequest;
Updated for RFC 5246: 
            struct {
              ClientCertificateType certificate_types <1..2 ^ 8 - 1>;
              SignatureAndHashAlgorithm supported_signature_algorithms <2 ^ 16 - 1>;
              DistinguishedName certificate_authorities <0..2 ^ 16 - 1>;
            } CertificateRequest;
Revised for RFC 8446: 
            struct {
              opaque certificate_request_context <0..2 ^ 8 - 1>;
              Extension extensions <2..2 ^ 16 - 1>;
            } CertificateRequest;
see for valid constants. an of . an array of certificate types an of (or null before TLS 1.2). an optional of . May be non-null from TLS 1.3 onwards. an of . Encode this to a . the of the current connection. the to encode to. Parse a from a the of the current connection. the to parse from. a object. an of (possibly null) . Encode this to a . the to encode to. Parse a from a . the of the current connection. the to parse from. a object. Implementation of the RFC 3546 3.6. CertificateStatusRequest. Encode this to a . the to encode to. Parse a from a . the to parse from. a object. Implementation of the RFC 6961 2.2. CertificateStatusRequestItemV2. Encode this to a . the to encode to. Parse a from a . the to parse from. a object. RFC 6091 RFC 3546 3.3 see for valid constants. an of . an of . Encode this to a . the to encode to. Parse a from a . the of the current connection. the to parse from. a object. a value. Encode this to a . the to encode to. Parse a from a . the of the current connection. the to parse from. a object. RFC 5056 Note that the values here are implementation-specific and arbitrary. It is recommended not to depend on the particular values (e.g.serialization). RFC 2246 A.5 RFC 2246 Note that the values here are implementation-specific and arbitrary. It is recommended not to depend on the particular values (e.g. serialization). Encode this to a . the of the current connection. the to encode to. Parse a from a . the to parse from. for DTLS this should be non-null; the input is copied to this , minus the cookie field. a object. A combined hash, which implements md5(m) || sha1(m). RFC 2246 6.1 RFC 2246 Note that the values here are implementation-specific and arbitrary. It is recommended not to depend on the particular values(e.g.serialization). RFC 2246 6.2.1 Carrier class for Diffie-Hellman group parameters. Base constructor with the prime factor of (p - 1). the prime modulus. specifies the prime factor of (p - 1). the base generator. Standard Diffie-Hellman groups from various IETF specifications. Base class for a TlsCrypto implementation that provides some needed methods from elsewhere in the impl package. Base class for a TlsSecret implementation which captures common code and fields. Base constructor. the byte[] making up the secret value. Credentialed class generating agreed secrets from a peer's public key for our end of the TLS connection using the BC light-weight API. Credentialed class decrypting RSA encrypted secrets sent from a peer for our end of the TLS connection using the BC light-weight API. Credentialed class for generating signatures based on the use of primitives from the BC light-weight API. Implementation class for a single X.509 certificate based on the BC light-weight API. Class for providing cryptographic services for TLS based on implementations in the BC light-weight API.

This class provides default implementations for everything. If you need to customise it, extend the class and override the appropriate methods.

Support class for ephemeral Diffie-Hellman using the BC light-weight library. BC light-weight support class for Diffie-Hellman key pair generation and key agreement over a specified Diffie-Hellman configuration. Support class for ephemeral Elliptic Curve Diffie-Hellman using the BC light-weight library. EC domain class for generating key pairs and performing key agreement. BC light-weight support class for handling TLS secrets and deriving key material and other secrets from them. A generic TLS 1.2 AEAD cipher. Base interface for services supporting AEAD encryption/decryption. Set the key to be used by the AEAD cipher implementation supporting this service. array holding the AEAD cipher key. offset into the array the key starts at. length of the key in the array. Initialise the parameters for the AEAD operator. the nonce. MAC size in bytes. any additional data to be included in the MAC calculation. if the parameters are inappropriate. Return the maximum size of the output for input of inputLength bytes. the length (in bytes) of the proposed input. the maximum size of the output. Perform the cipher encryption/decryption returning the output in output. Note: we have to use DoFinal() here as it is the only way to guarantee output from the underlying cipher. array holding input data to the cipher. offset into input array data starts at. length of the input data in the array. array to hold the cipher output. offset into output array to start saving output. the amount of data written to output. in case of failure. A generic TLS 1.0-1.2 block cipher. This can be used for AES or 3DES for example. Interface for block cipher services. Set the key to be used by the block cipher implementation supporting this service. array holding the block cipher key. offset into the array the key starts at. length of the key in the array. Initialise the parameters for operator. array holding the initialization vector (IV). offset into the array the IV starts at. length of the IV in the array. if the parameters are inappropriate. Perform the cipher encryption/decryption returning the output in output. Note: we have to use DoFinal() here as it is the only way to guarantee output from the underlying cipher. array holding input data to the cipher. offset into input array data starts at. length of the input data in the array. array to hold the cipher output. offset into output array to start saving output. the amount of data written to output. in case of failure. Return the blocksize (in bytes) of the underlying block cipher. the cipher's blocksize. Useful utility methods. The NULL cipher. A generic TLS MAC implementation, acting as an HMAC based on some underlying Digest. Generate a new instance of a TlsMac. the TLS client context specific crypto parameters. The MAC to use. Base interface for a generic TLS MAC implementation for use with a bulk cipher. Return the output length (in bytes) of this MAC. The output length of this MAC. Calculate the MAC for some given data. The sequence number of the record. The content type of the message. A byte array containing the message. The number of bytes to skip, before the message starts. The length of the message. A new byte array containing the MAC value. Constant time calculation of the MAC for some given data with a given expected length. The sequence number of the record. The content type of the message. A byte array containing the message. The number of bytes to skip, before the message starts. The length of the message. The expected length of the full message. Random data for padding out the MAC calculation if required. A new byte array containing the MAC value. Base interface for ephemeral key agreement calculator. Generate an ephemeral key pair, returning the encoding of the public key. a byte encoding of the public key. Pass in the public key for the peer to the agreement calculator. a byte encoding of the peer public key. Calculate the agreed secret based on the calculator's current state. the calculated secret. Interface providing the functional representation of a single X.509 certificate. Return an encryptor based on the public key in this certificate. a based on this certificate's public key. the OID of this certificate's 'signatureAlgorithm', as a string. true if (and only if) this certificate can be used to verify the given signature algorithm. Base interface for a TLS bulk cipher. Return the maximum input size for a ciphertext given a maximum output size for the plaintext of plaintextLimit bytes. the maximum output size for the plaintext. the maximum input size of the ciphertext for plaintextlimit bytes of output. Return the maximum output size for a ciphertext given an actual input plaintext size of plaintextLength bytes and a maximum input plaintext size of plaintextLimit bytes. the actual input size for the plaintext. the maximum input size for the plaintext. the maximum output size of the ciphertext for plaintextlimit bytes of input. Return the maximum size for the plaintext given ciphertextlimit bytes of ciphertext. the maximum number of bytes of ciphertext. the maximum size of the plaintext for ciphertextlimit bytes of input. Encode the passed in plaintext using the current bulk cipher. sequence number of the message represented by plaintext. content type of the message represented by plaintext. used for the record. extra bytes to allocate at start of returned byte array. array holding input plaintext to the cipher. offset into input array the plaintext starts at. length of the plaintext in the array. A containing the result of encoding (after 'headerAllocation' unused bytes). Decode the passed in ciphertext using the current bulk cipher. sequence number of the message represented by ciphertext. content type used in the record for this message. used for the record. array holding input ciphertext to the cipher. offset into input array the ciphertext starts at. length of the ciphertext in the array. A containing the result of decoding. Service and object creation interface for the primitive types and services that are associated with cryptography in the API. Return true if this TlsCrypto would use a stream verifier for any of the passed in algorithms. This method is only relevant to handshakes negotiating (D)TLS 1.2. A list of values. true if this instance would use a stream verifier for any of the passed in algorithms, otherwise false. Return true if this TlsCrypto would use a stream verifier for any of the passed in algorithms. This method is only relevant to handshakes negotiating (D)TLS versions older than 1.2. An array of values. true if this instance would use a stream verifier for any of the passed in algorithms, otherwise false. Return true if this TlsCrypto can support the passed in hash algorithm. the algorithm of interest. true if cryptoHashAlgorithm is supported, false otherwise. Return true if this TlsCrypto can support the passed in signature algorithm (not necessarily in combination with EVERY hash algorithm). the algorithm of interest. true if cryptoSignatureAlgorithm is supported, false otherwise. Return true if this TlsCrypto can support DH key agreement. true if this instance can support DH key agreement, false otherwise. Return true if this TlsCrypto can support ECDH key agreement. true if this instance can support ECDH key agreement, false otherwise. Return true if this TlsCrypto can support the passed in block/stream encryption algorithm. the algorithm of interest. true if encryptionAlgorithm is supported, false otherwise. Return true if this TlsCrypto can support HKDF with the passed in hash algorithm. the algorithm of interest. true if HKDF is supported with cryptoHashAlgorithm, false otherwise. Return true if this TlsCrypto can support the passed in MAC algorithm. the algorithm of interest. true if macAlgorithm is supported, false otherwise. Return true if this TlsCrypto supports the passed in named group value. true if this instance supports the passed in named group value. Return true if this TlsCrypto can support RSA encryption/decryption. true if this instance can support RSA encryption/decryption, false otherwise. Return true if this TlsCrypto can support the passed in signature algorithm (not necessarily in combination with EVERY hash algorithm). true if signatureAlgorithm is supported, false otherwise. Return true if this TlsCrypto can support the passed in signature algorithm. the algorithm of interest. true if sigAndHashAlgorithm is supported, false otherwise. Return true if this TlsCrypto can support the passed in signature scheme. the scheme of interest. true if signatureScheme is supported, false otherwise. Create a TlsSecret object based on provided data. the data to base the TlsSecret on. a TlsSecret based on the provided data. Create a TlsSecret object containing a randomly-generated RSA PreMasterSecret the client version to place in the first 2 bytes a TlsSecret containing the PreMasterSecret. Return the primary (safest) SecureRandom for this crypto. a SecureRandom suitable for key generation. Create a TlsCertificate from an ASN.1 binary encoding of an X.509 certificate. DER/BER encoding of the certificate of interest. a TlsCertificate. if there is an issue on decoding or constructing the certificate. Create a cipher for the specified encryption and MAC algorithms. See enumeration classes , for appropriate argument values. context specific parameters. the encryption algorithm to be employed by the cipher. the MAC algorithm to be employed by the cipher. a implementing the encryption and MAC algorithms. Create a domain object supporting the domain parameters described in dhConfig. the config describing the DH parameters to use. a TlsDHDomain supporting the parameters in dhConfig. Create a domain object supporting the domain parameters described in ecConfig. the config describing the EC parameters to use. a TlsECDomain supporting the parameters in ecConfig. Adopt the passed in secret, creating a new copy of it. the secret to make a copy of. a TlsSecret based on the original secret. Create a suitable hash for the hash algorithm identifier passed in. See enumeration class for appropriate argument values. the hash algorithm the hash needs to implement. a . Create a suitable HMAC for the MAC algorithm identifier passed in. See enumeration class for appropriate argument values. the MAC algorithm the HMAC needs to match. a . Create a suitable HMAC using the hash algorithm identifier passed in. See enumeration class for appropriate argument values. the hash algorithm the HMAC should use. a . Create a nonce generator. Each call should construct a new generator, and the generator should be returned from this call only after automatically seeding from this 's entropy source, and from the provided additional seed material. The output of each returned generator must be completely independent of the others. context-specific seed material a . Setup an initial "secret" for a chain of HKDF calls (RFC 5869), containing a string of HashLen zeroes. the hash algorithm to instantiate HMAC with. See for values. Basic exception class for crypto services to pass back a cause. Carrier class for context-related parameters needed for creating secrets and ciphers. Base constructor. the context for this parameters object. Basic config for Diffie-Hellman. Domain interface to service factory for creating Diffie-Hellman operators. Return an agreement operator suitable for ephemeral Diffie-Hellman. a key agreement operator. Carrier class for Elliptic Curve parameter configuration. Return the group used. the named group used. Domain interface to service factory for creating Elliptic-Curve (EC) based operators. Return an agreement operator suitable for ephemeral EC Diffie-Hellman. a key agreement operator. Base interface for an encryptor. Encrypt data from the passed in input array. byte array containing the input data. the encrypted data. Interface for message digest, or hash, services. Update the hash with the passed in input. input array containing the data. offset into the input array the input starts at. the length of the input data. Return calculated hash for any input passed in. the hash value. Reset the hash underlying this service. Interface for MAC services based on HMAC. Return the internal block size for the message digest underlying this HMAC service. the internal block size for the digest (in bytes). Interface for MAC services. Set the key to be used by the MAC implementation supporting this service. array holding the MAC key. offset into the array the key starts at. length of the key in the array. Update the MAC with the passed in input. input array containing the data. offset into the input array the input starts at. the length of the input data. Return calculated MAC for any input passed in. the MAC value. Write the calculated MAC to an output buffer. output array to write the MAC to. offset into the output array to write the MAC to. Return the length of the MAC generated by this service. the MAC length. Reset the MAC underlying this service. Generate a nonce byte[] string. the length, in bytes, of the nonce to generate. the nonce value. The cipher for TLS_NULL_WITH_NULL_NULL. Interface supporting the generation of key material and other TLS secret values from PRFs. Calculate an HMAC with this secret's data as the key. the hash algorithm to instantiate HMAC with. See for values. array containing the input data. offset into the input array the input starts at. the length of the input data. Return a new secret based on applying a PRF to this one. PRF algorithm to use. the label details. the seed details. the size (in bytes) of the secret to generate. the new secret. Destroy the internal state of the secret. After this call, any attempt to use the will result in an being thrown. Return an encrypted copy of the data this secret is based on. the encryptor to use for protecting the internal data. an encrypted copy of this secret's internal data. Return the internal data from this secret. The does not keep a copy of the data. After this call, any attempt to use the will result in an being thrown. the secret's internal data. RFC 5869 HKDF-Expand function, with this secret's data as the pseudo-random key ('prk'). the hash algorithm to instantiate HMAC with. See for values. optional context and application specific information (can be zero-length). length of output keying material in octets. output keying material (of 'length' octets). RFC 5869 HKDF-Extract function, with this secret's data as the 'salt'. The does not keep a copy of the data. After this call, any attempt to use the will result in an being thrown. the hash algorithm to instantiate HMAC with. See for values. input keying material. a pseudo-random key (of HashLen octets). Base interface for a TLS signer that works on raw message digests. Generate an encoded signature based on the passed in hash. the signature algorithm to use. the hash calculated for the signature. an encoded signature. in case of an exception processing the hash. Base interface for a TLS verifier that works with signatures and either raw message digests, or entire messages. Return true if the passed in signature and hash represent a real signature. the signature object containing the signature to be verified. the hash calculated for the signature. true if signature verifies, false otherwise. in case of an exception verifying signature. Base interface for an object sending and receiving DTLS data. Container class for generating signatures that carries the signature type, parameters, public key certificate and public key's associated signer object. Accept named groups and various standard DH groups with 'P' at least bits. Accept named groups and various standard DH groups with 'P' at least the specified number of bits. the minimum bitlength of 'P'. Accept named groups and a custom set of group parameters, subject to a minimum bitlength for 'P'. a list of acceptable s. the minimum bitlength of 'P'. Buffers input until the hash algorithm is determined. a (or null before TLS 1.2). Encode this to a . the to encode to. Parse a from a . the of the current connection. the to parse from. a object. Check that there are no "extra" messages left in the current inbound flight RFC 4347 4.1.2.5 Anti-replay

Support fast rejection of duplicate records by maintaining a sliding receive window

Check whether a received record with the given sequence number should be rejected as a duplicate. the 48-bit DTLSPlainText.sequence_number field of a received record. true if the record should be discarded without further processing. Report that a received record with the given sequence number passed authentication checks. the 48-bit DTLSPlainText.sequence_number field of an authenticated record. RFC 4492 5.4 Indicates the elliptic curve domain parameters are conveyed verbosely, and the underlying finite field is a prime field. Indicates the elliptic curve domain parameters are conveyed verbosely, and the underlying finite field is a characteristic-2 field. Indicates that a named curve is used. This option SHOULD be used when applicable. RFC 4492 5.1.2 RFC 2246 Note that the values here are implementation-specific and arbitrary. It is recommended not to depend on the particular values (e.g. serialization). RFC 5705 RFC 5246 7.4.1.4.1 Encode this to a . the to encode to. Parse a from a . the to parse from. a object. Encode this to a . the to encode to. Parse a from a . the to parse from. a object. RFC 6520 3. RFC 6066 RFC 2246 Note that the values here are implementation-specific and arbitrary. It is recommended not to depend on the particular values (e.g. serialization). Encode this to a . the to encode to. Parse a from a . the to parse from. a object. RFC 8446 4.6.3 RFC 2246 Note that the values here are implementation-specific and arbitrary. It is recommended not to depend on the particular values (e.g. serialization). RFC 7919 Note that the values here are implementation-specific and arbitrary. It is recommended not to depend on the particular values (e.g. serialization). Encode this to a . the to encode to. Parse a from a . the to parse from. a object. RFC 3546 3.6 an of , specifying the list of trusted OCSP responders. An empty list has the special meaning that the responders are implicitly known to the server - e.g., by prior arrangement. OCSP request extensions. A null value means that there are no extensions. an of . OCSP request extensions. Encode this to a . the to encode to. Parse an from a . the to parse from. an object. RFC 5246 Note that the values here are implementation-specific and arbitrary. It is recommended not to depend on the particular values (e.g. serialization). RFC 7301 Represents a protocol name for use with ALPN. Encode this to a . the to encode to. Parse a from a . the to parse from. a object. An implementation of the TLS 1.0/1.1/1.2 record layer. Encode this to a . the of the current connection. the to encode to. Parse a from a . the to parse from. a object. RFC 6066 3. Server Name Indication Current implementation uses this guidance: "For backward compatibility, all future data structures associated with new NameTypes MUST begin with a 16-bit length field. TLS MAY treat provided server names as opaque data and pass the names and types to the application.". RFC 6066 specifies ASCII encoding for host_name (possibly using A-labels for IDNs), but note that the previous version (RFC 4366) specified UTF-8 encoding (see RFC 6066 Appendix A). For maximum compatibility, it is recommended that client code tolerate receiving UTF-8 from the peer, but only generate ASCII itself. Encode this to a . the to encode to. Parse a from a . the to parse from. a object. an of . an of . Encode this to a . the to encode to . Parse a from a . the to parse from. a object. RFC 5246 7.4.1.4.1 (in RFC 2246, there were no specific values assigned) RFC 5246 7.4.1.4.1 Encode this to a . the to encode to. Parse a from a . the to parse from. a object. For TLS 1.3+ usage, some signature schemes are constrained to use a particular ({@link NamedGroup}. Not relevant for TLS 1.2 and below. RFC 4680 Base interface to provide TLS authentication credentials. Called by the protocol handler to report the server certificate. Note: this method is responsible for certificate verification and validation. the server certificate received. Return client credentials in response to server's certificate request. The returned value may be null, or else it MUST implement exactly one of , , or , depending on the key exchange that was negotiated and the details of the . details of the certificate request. a object or null for no client authentication. Return the session this client wants to resume, if any. Note that the peer's certificate chain for the session (if any) may need to be periodically revalidated. A representing the resumable session to be used for this connection, or null to use a new session. Return the external PSKs to offer in the ClientHello. This will only be called when TLS 1.3 or higher is amongst the offered protocol versions. an of instances, or null if none should be offered. (Int32 -> byte[]) If this client is offering TLS 1.3 or higher, this method may be called to determine for which groups a key share should be included in the initial ClientHello. Groups that were not included in the supported_groups extension (by will be ignored. The protocol will then add a suitable key_share extension to the ClientHello extensions. an of named group values, possibly empty or null. Notifies the client of the session that will be offered in ClientHello for resumption, if any. This will be either the session returned from {@link #getSessionToResume()} or null if that session was unusable. NOTE: the actual negotiated session_id is notified by . The representing the resumable session to be offered for this connection, or null if there is none. Notifies the client of the session_id sent in the ServerHello. The protocol implementation validates that any server extensions received correspond to client extensions sent. If further processing of the server extensions is needed, it can be done in this callback. NOTE: This is not called for session resumption handshakes. (Int32 -> byte[]) (SupplementalDataEntry) (SupplementalDataEntry) RFC 5077 3.3. NewSessionTicket Handshake Message This method will be called (only) when a NewSessionTicket handshake message is received. The ticket is opaque to the client and clients MUST NOT examine the ticket under the assumption that it complies with e.g. RFC 5077 4. "Recommended Ticket Construction". The ticket. Marker interface to distinguish a TLS client context. Constructor for non-blocking mode. When data is received, use to provide the received ciphertext, then use to read the corresponding cleartext.

Similarly, when data needs to be sent, use to provide the cleartext, then use to get the corresponding ciphertext. Constructor for blocking mode. The of data to/from the server. Constructor for blocking mode. The of data from the server. The of data to the server. Initiates a TLS handshake in the role of client. In blocking mode, this will not return until the handshake is complete. In non-blocking mode, use to receive a callback when the handshake is complete. The to use for the handshake. If in blocking mode and handshake was not successful. Base interface for a TLS context implementation. Return true if this context is for a server, false otherwise. true for a server based context, false for a client based one. Used to get the resumable session, if any, used by this connection. Only available after the handshake has successfully completed. A representing the resumable session used by this connection, or null if no resumable session available. Used to get the session information for this connection. Only available after the handshake has successfully completed. Use to find out if the session is resumable. A representing the session used by this connection. Export the value of the specified channel binding. Only available after the handshake has successfully completed. A constant specifying the channel binding to export. A copy of the channel binding data as a byte[], or null if the binding could not be determined. Export (early data) keying material according to RFC 5705: "Keying Material Exporters for TLS", as updated for TLS 1.3 (RFC 8446). NOTE: for use in settings where an exporter is needed for 0-RTT data. indicates which application will use the exported keys. allows the application using the exporter to mix its own data with the TLS PRF for the exporter output. the number of bytes to generate. a pseudorandom bit string of 'length' bytes generated from the (exporter_)master_secret. Export keying material according to RFC 5705: "Keying Material Exporters for TLS", as updated for TLS 1.3 (RFC 8446) when negotiated. indicates which application will use the exported keys. allows the application using the exporter to mix its own data with the TLS PRF for the exporter output. the number of bytes to generate. a pseudorandom bit string of 'length' bytes generated from the (exporter_)master_secret. Support interface for generating a secret based on the credentials sent by a TLS peer. Calculate an agreed secret based on our credentials and the public key credentials of our peer. public key certificate of our TLS peer. the agreed secret. in case of an exception on generation of the secret. Base interface for a class that decrypts TLS secrets. Decrypt the passed in cipher text using the parameters available. the parameters to use for the decryption. the cipher text containing the secret. a TLS secret. on a parsing or decryption error. Support interface for generating a signature based on our private credentials. Generate a signature against the passed in hash. a message digest calculated across the message the signature is to apply to. an encoded signature. if the hash cannot be processed, or there is an issue with the private credentials. Return the algorithm IDs for the signature algorithm and the associated hash it uses. the full algorithm details for the signature. Base interface for interfaces/classes carrying TLS credentials. Return the certificate structure representing our identity. our certificate structure. (D)TLS DH_anon key exchange. Interface for verifying explicit Diffie-Hellman group parameters. Check whether the given DH group is acceptable for use. the to check. true if (and only if) the specified group is acceptable. (D)TLS DH key exchange. (D)TLS ECDH_anon key exchange (see RFC 4492). (D)TLS ECDHE key exchange (see RFC 4492). (D)TLS ECDH key exchange (see RFC 4492). (Int32 -> byte[]) an of . an of . an of . an of . Base interface for an object that can calculate a handshake hash. A generic interface for key exchange implementations in (D)TLS. Interface for a key exchange factory offering a variety of specific algorithms. This exception will be thrown (only) when the connection is closed by the peer without sending a close_notify warning alert. If this happens, the TLS protocol cannot rule out truncation of the connection data (potentially malicious). It may be possible to check for truncation via some property of a higher level protocol built upon TLS, e.g.the Content-Length header for HTTPS. Object Identifiers associated with TLS extensions. RFC 7633 Base interface for a (D)TLS endpoint. Notifies the peer that a new handshake is about to begin. Specify the timeout, in milliseconds, to use for the complete handshake process. NOTE: Currently only respected by DTLS protocols. Negative values are not allowed. A timeout of zero means an infinite timeout (i.e.the handshake will never time out). the handshake timeout, in milliseconds. This option is provided as a last resort for interoperability with TLS peers that fail to correctly send a close_notify alert at end of stream. Implementations SHOULD return true; caution is advised if returning false without a full understanding of the implications. This implementation supports RFC 7627 and will always negotiate the extended_master_secret extension where possible. When connecting to a peer that does not offer/accept this extension, it is recommended to abort the handshake.This option is provided for interoperability with legacy peers, although some TLS features will be disabled in that case (see RFC 7627 5.4). true if the handshake should be aborted when the peer does not negotiate the extended_master_secret extension, or false to support legacy interoperability. See RFC 5246 6.2.3.2. Controls whether block cipher encryption may randomly add extra padding beyond the minimum. Note that in configurations where this is known to be potential security risk this setting will be ignored (and extended padding disabled). Extra padding is always supported when decrypting received records. true if random extra padding should be added during block cipher encryption, or false to always use the minimum amount of required padding. draft-mathewson-no-gmtunixtime-00 2. "If existing users of a TLS implementation may rely on gmt_unix_time containing the current time, we recommend that implementors MAY provide the ability to set gmt_unix_time as an option only, off by default.". NOTE: For a server that has negotiated TLS 1.3 (or later), or a client that has offered TLS 1.3 (or later), this is not called and gmt_unix_time is not used. true if the current time should be used in the gmt_unix_time field of Random, or false if gmt_unix_time should contain a cryptographically random value. RFC 5746 3.4/3.6. In case this is false, peers may want to terminate the handshake instead of continuing; see Section 4.1/4.3 for discussion. NOTE: TLS 1.3 forbids renegotiation, so this is never called when TLS 1.3 (or later) was negotiated. This method will be called when an alert is raised by the protocol. A human-readable message explaining what caused this alert. May be null. The that caused this alert to be raised. May be null. This method will be called when an alert is received from the remote peer. Notifies the peer that the handshake has been successfully completed. Return a instance that will control the generation of heartbeats locally (if permitted by the remote peer), or null to not generate heartbeats. Heartbeats are described in RFC 6520. an instance of . Return the heartbeat mode applicable to the remote peer. Heartbeats are described in RFC 6520. See enumeration class for appropriate return values. the value. This method is called, when a change cipher spec message is received. If the message has an invalid content or the handshake is not in the correct state. Read data from the network. The method will return immediately, if there is still some data left in the buffer, or block until some application data has been read from the network. The buffer where the data will be copied to. The position where the data will be placed in the buffer. The maximum number of bytes to read. The number of bytes read. If something goes wrong during reading data. Write some application data. Fragmentation is handled internally. Usable in both blocking/non-blocking modes.

In blocking mode, the output will be automatically sent via the underlying transport. In non-blocking mode, call to get the output bytes to send to the peer.

This method must not be called until after the initial handshake is complete. Attempting to call it earlier will result in an . The buffer containing application data to send. The offset at which the application data begins The number of bytes of application data. If called before the initial handshake has completed. If connection is already closed, or for encryption or transport errors. The secure bidirectional stream for this connection Only allowed in blocking mode. Should be called in non-blocking mode when the input data reaches EOF. Equivalent to OfferInput(input, 0, input.Length). The input buffer to offer. Offer input from an arbitrary source. Only allowed in non-blocking mode.

This method will decrypt and process all records that are fully available. If only part of a record is available, the buffer will be retained until the remainder of the record is offered.

If any records containing application data were processed, the decrypted data can be obtained using . If any records containing protocol data were processed, a response may have been generated. You should always check to see if there is any available output after calling this method by calling . The input buffer to offer. The offset within the input buffer that input begins. The number of bytes of input being offered. If an error occurs while decrypting or processing a record. Gets the amount of received application data. A call to is guaranteed to be able to return at least this much data.

Only allowed in non-blocking mode. The number of bytes of available application data. Retrieves received application data. Use to check how much application data is currently available. This method functions similarly to , except that it never blocks. If no data is available, nothing will be copied and zero will be returned.

Only allowed in non-blocking mode. The buffer to hold the application data. The start offset in the buffer at which the data is written. The maximum number of bytes to read. The total number of bytes copied to the buffer. May be less than the length specified if the length was greater than the amount of available data. Gets the amount of encrypted data available to be sent. A call to is guaranteed to be able to return at least this much data. Only allowed in non-blocking mode. The number of bytes of available encrypted data. Retrieves encrypted data to be sent. Use to check how much encrypted data is currently available. This method functions similarly to , except that it never blocks. If no data is available, nothing will be copied and zero will be returned. Only allowed in non-blocking mode. The buffer to hold the encrypted data. The start offset in the buffer at which the data is written. The maximum number of bytes to read. The total number of bytes copied to the buffer. May be less than the length specified if the length was greater than the amount of available data. Make sure the 'buf' is now empty. Fail otherwise. The to check. Processor interface for a PSK identity. Base interface for an object that can process a PSK identity. (D)TLS PSK key exchange (RFC 4279). (D)TLS RSA key exchange. Interface describing a TLS server endpoint. Return the specified session, if available. Note that the peer's certificate chain for the session (if any) may need to be periodically revalidated. the ID of the session to resume. A with the specified session ID, or null. Return the external PSK to select from the ClientHello. WARNING: EXPERIMENTAL FEATURE, UNSTABLE API Note that this will only be called when TLS 1.3 or higher is amongst the offered protocol versions, and one or more PSKs are actually offered. an of instances. The corresponding to the selected identity, or null to not select any. (Int32 -> byte[]) (Int32 -> byte[]) (Int32 -> byte[]) (SupplementalDataEntry) Return server credentials to use. The returned value may be null, or else it MUST implement exactly one of , , or , depending on the key exchange that was negotiated. a object or null for anonymous key exchanges. This method will be called (only) if the server included an extension of type "status_request" with empty "extension_data" in the extended server hello. See RFC 3546 3.6. Certificate Status Request. If a non-null is returned, it is sent to the client as a handshake message of type "certificate_status". A to be sent to the client (or null for none). (SupplementalDataEntry) Called by the protocol handler to report the client certificate, only if returned non-null. Note: this method is responsible for certificate verification and validation. the effective client certificate (may be an empty chain). RFC 5077 3.3. NewSessionTicket Handshake Message. This method will be called (only) if a NewSessionTicket extension was sent by the server. See RFC 5077 4. Recommended Ticket Construction for recommended format and protection. The ticket. Server certificate carrier interface. Marker interface to distinguish a TLS server context. Constructor for non-blocking mode. When data is received, use to provide the received ciphertext, then use to read the corresponding cleartext.

Similarly, when data needs to be sent, use to provide the cleartext, then use to get the corresponding ciphertext. Constructor for blocking mode. The of data to/from the server. Constructor for blocking mode. The of data from the server. The of data to the server. Receives a TLS handshake in the role of server. In blocking mode, this will not return until the handshake is complete. In non-blocking mode, use to receive a callback when the handshake is complete. The to use for the handshake. If in blocking mode and handshake was not successful. Base interface for a carrier object for a TLS session. RFC 5764 DTLS Extension to Establish Keys for SRTP. Whether a server can select the specified cipher suite given the available signature algorithms for ServerKeyExchange. Check the signature algorithm for certificates in the peer's CertPath as specified in RFC 5246 7.4.2, 7.4.4, 7.4.6 and similar rules for earlier TLS versions. The supplied CertPath should include the trust anchor (its signature algorithm isn't checked, but in the general case checking a certificate requires the issuer certificate). if any certificate in the CertPath (excepting the trust anchor) has a signature algorithm that is not one of the locally supported signature algorithms. Generate a pre_master_secret and send it encrypted to the server. Encode this to a . the to encode to. Parse a from a . the to parse from. a object. RFC 6066 5. Encode this to a . the to encode to. Parse a from a . the of the current connection. the to parse from. a object. RFC 4681 RFC 5764 4.1.1 see for valid constants. valid lengths from 0 to 255. see for valid constants. valid lengths from 0 to 255.