nx_tls13_schedule.nx

nx_tls13_schedule.nx -- TLS 1.3 key schedule cascade (RFC 8446 §7.1). Phase 0b §D of the Nishi TLS 1.3 stack per docs/NISHI_TLS13_GAP_AUDIT.md. Composes the just-landed nx_hkdf + nx_tls13_kdf into the named 5-stage cascade that produces every secret a TLS 1.3 session needs. The cascade (no-PSK case, which is the 99%-common one): 0 | v HKDF-Extract(salt=0^Hash, IKM=0^Hash) = early_secret | v Derive-Secret(., "derived", "") = derived_1 (salt for next HKDF-Extract) | v ECDHE shared HKDF-Extract(salt=derived_1, IKM=ECDHE) = handshake_secret | +--> Derive-Secret(., "c hs traffic", H1) = client_hs_traffic_secret +--> Derive-Secret(., "s hs traffic", H1) = server_hs_traffic_secret v Derive-Secret(., "derived", "") = derived_2 (salt for next HKDF-Extract) | v HKDF-Extract(salt=derived_2, IKM=0^Hash) = master_secret | +--> Derive-Secret(., "c ap traffic", H2) = client_app_traffic_secret_0 +--> Derive-Secret(., "s ap traffic", H2) = server_app_traffic_secret_0 +--> Derive-Secret(., "exp master", H2) = exporter_master_secret +--> Derive-Secret(., "res master", H3) = resumption_master_secret Then per-traffic-secret AEAD key + IV derivation: key = HKDF-Expand-Label(traffic_secret, "key", "", key_length) iv = HKDF-Expand-Label(traffic_secret, "iv", "", iv_length) finished_key = HKDF-Expand-Label(traffic_secret, "finished", "", Hash.length) All transcript hashes (H1, H2, H3) are caller-supplied because