nx_tls13_handshake.nx

nx_tls13_handshake.nx -- TLS 1.3 handshake orchestrator (Gap L sub-1). Phase 0b §L of the Nishi TLS 1.3 stack per docs/NISHI_TLS13_GAP_AUDIT.md. Composes the shipped primitives (ECDHE + transcript + schedule + KDF) into the small set of state-machine functions a TLS 1.3 client needs. This is NOT yet a full nx_tls13_connect() with sockets. It is the IN-MEMORY orchestrator that takes byte buffers + keys in and produces the next byte buffers + keys out. A future thin wrapper drives this from a TCP socket. Separating logic from transport keeps the substrate testable end-to-end without network, matching the RFC 8448 §3 KAT pattern. What it does today: - tls13_handshake_compute_handshake_keys: given client X25519 private key + server X25519 public key + the running transcript hash state (already-fed with CH+SH), derives handshake_secret + client/server handshake_traffic_secrets + their AEAD keys + IVs. This is the moment in the handshake where everything past ServerHello becomes encrypted. - tls13_handshake_compute_application_keys: given handshake_secret + transcript-state at the post-server-Finished point, derives master_secret + client/server app_traffic_secrets + their AEAD keys + IVs. This is the moment the handshake completes and application data starts flowing. What it doesn't do yet: - record-layer I/O (caller still drives nx_tls13_record directly for now; integration ships when the full state machine lands) - HRR retry loop (the HRR detection + transcript replace are both shipped; an outer state-machine retries with the server-chosen group from HRR's key_share extension) - PSK / resumption path (Gap M) KAT verified: - RFC 8448 §3 ECDHE computation: x25519(client_priv=49af...5005, server_pub=c982...1f0f)