The first release of the TLS 1.3 protocol implementation in Java with GOST algorithms according to RFC 9367

Module crypto-gost-tls13 contains an implementation of TLS 1.3 (RFC 8446 + RFC 9367) with GOST cryptography. This release is the initial version of the library and is ready for internal use.

A distinctive feature of the library is its implementation in pure Java. All cryptographic operations are performed using the library's built-in features — without external dependencies.

This is one of the first open implementations of TLS 1.3 with GOST on Java, so interop testing has been done in the minimally available scope.

Below are the capabilities of the library.

1. Protocols:

• Handshake: full (client/server), abbreviated (PSK), mutual (mTLS).
• ALPN (RFC 7301) — application layer protocol negotiation (HTTP/2, HTTP/1.1).
• SNI (RFC 6066) — name indication server for multi-tenant deployments.
• KeyUpdate (RFC 8446 §4.6.3) — updating traffic encryption keys.
• Cipher suites: TLS_KUZNYECHIK_MGM_STREEBOG_256_L/S.
• ECDHE: CryptoPro-A (256-bit), CryptoPro-B (512-bit)
• Per-record TLSTREE re-keying — changing the encryption key for each TLS record.
• Fragmentation and assembly of handshakes and records (RFC 8446 §5.1).
• Session resumption: PSK via NewSessionTicket (PskStore in-memory, single-use).
• OCSP stapling: server attaches the OCSP response to the certificate.
• Post-handshake messages: NewSessionTicket (saved for PSK).

2. Cryptography:

• Key schedule: HKDF-Streebog (RFC 5869) according to TLS 1.3 scheme (RFC 8446 §7.1).
• Record protection: MGM-AEAD (Kuznyechik) with nonce as per RFC 8446 §5.3.
• Ephemeral keys are wiped after use.

3. Certificates:

• Parsing X.509v3 (GOST R 34.10-2012) — built-in DER parser.
• Chain validation: signatures, DN (issuer → subject), Basic Constraints, Key Usage, Extended Key Usage (serverAuth/clientAuth), pathLen.
• Hostname verification: dNSName + iPAddress (RFC 6125).
• Verifying OCSP responses (RFC 6960).

4.Transport:

• TlsTransport — interface.
• InMemoryTlsTransport — for tests and single-process scenarios (in-memory queue).
• SocketTlsTransport — blocking I/O via java.net.Socket.
• ChannelTlsTransport — NIO SocketChannel-based transport (blocking mode, interruptible).

5. Step-by-step handshake:

• TlsHandshakeEngine — state machine for handshake (decoupled from I/O). TlsSession is used as an orchestrator; suitable for integration with JSSE (SSLEngine).

6. ByteBuffer API:

• TlsRecord.protect/unprotect — ByteBuffer overloads for zero-copy integration with NIO. Key loading:
• Pkcs12Loader — reading PFX (PKCS#12) with PBKDF2-HMAC-SHA256 + AES-256-CBC.

7. Session termination:

• close_notify — correct closure according to the protocol.
• Wiping key material upon closure or error.
• Alert handling: fatal — immediate closure + wiping.

8. Implementation security:

• Constant-time comparison for verify_data and PSK binders (protection against timing attacks)
• Key material zeroing: destroy() on all objects with keys (TlsKeySchedule, TlsTrafficKeys, TlsRecord, HandshakeContext), during close, fatal alert, exception in handshake
• DoS protection: limits on certificate chain length (10), post-handshake messages, record size.
• MGM nonce: MSB of the first byte is cleared for ICN (RFC 9058 §3, RFC 9367 §3.3).
• ECDHE private key and handshake transcript are destroyed after completion of the handshake.
• HMAC key material is zeroed after use (HkdfStreebog, KdfGostR3411_2012_256).

9. Limitations:

• Only resumption PSK (0-RTT and external PSK are not supported).
• Only psk_dhe_ke (pure PSK without ECDHE is not supported).
• HelloRetryRequest (RFC 8446 §4.1.4) is not supported — only one named group is used (GC256A by default).
• Only GOST (non-GOST cipher suites are not supported).

10. Testing:

• The library contains Known Answer Tests from RFC 9367 Appendix A.1 (L and S variants) — complete key schedule, TLSTREE, AEAD, ECDHE. It passes a full range of KAT tests.
• 4 integration tests (self-interop) via real TCP sockets.
• Fuzz testing for parsers: TlsMessageParser (8 methods), TlsDerParser (3 methods), TlsOcspVerifier (1 method), to ensure security and reduce the attack vector on parsers.

11. Architectural solutions:

• TlsHandshakeEngine — a state machine decoupled from I/O (for future JSSE module).
• ByteBuffer overloads TlsRecord.protect/unprotect for NIO/JSSE.
• TLSTREE cache (TlsTreeCache) — recalculation only of changed levels (RFC 9367).
• InMemoryTlsTransport.Pair — a bidirectional pair for testing and single-process interaction.

The library is distributed under a free license.

Source: linux.org.ru