Skip to content

add support for key exporters - #310

Draft
marten-seemann wants to merge 1 commit into
masterfrom
key-exporter
Draft

add support for key exporters#310
marten-seemann wants to merge 1 commit into
masterfrom
key-exporter

Conversation

@marten-seemann

@marten-seemann marten-seemann commented Jun 28, 2026

Copy link
Copy Markdown
Member

Fixes #115.

Waiting for @mxinden to cut a new Neqo release that includes mozilla/neqo#3464, so we can test with Firefox Nightly.

Note

Add Session.ExportKeyingMaterial for TLS keying material export

  • Adds ExportKeyingMaterial on Session in session.go, which derives keying material via the TLS exporter using the label "EXPORTER-WebTransport" and a constructed context containing the session ID, label, and context bytes.
  • Input validation enforces label and context lengths <= 255 bytes and a non-negative output length.
  • The exporter context is scoped per-session by prepending the 8-byte big-endian session ID, ensuring different sessions produce different keying material for the same label and context.

Macroscope summarized 5a264bd.

@codecov

codecov Bot commented Jun 28, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.87%. Comparing base (c6510ea) to head (5a264bd).
✅ All tests successful. No failed tests found.

Additional details and impacted files
@@            Coverage Diff             @@
##           master     #310      +/-   ##
==========================================
+ Coverage   81.66%   81.87%   +0.20%     
==========================================
  Files          10       10              
  Lines        1342     1357      +15     
==========================================
+ Hits         1096     1111      +15     
  Misses        172      172              
  Partials       74       74              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

@tomholford tomholford mentioned this pull request Jul 5, 2026
34 tasks
@mxinden

mxinden commented Aug 2, 2026

Copy link
Copy Markdown

The Firefox side has landed, so this should be unblocked.

  • neqo: the key exporter (mozilla/neqo#3464) shipped in neqo v0.30.0 and is in the latest v0.30.1.
  • Firefox: WebTransport.exportKeyingMaterial() landed in Firefox 155 via bug 2007200, wired through to neqo, and it is enabled by default (network.webtransport.enabled). So it is available in current Nightly without any flag.

One heads-up: the API recently followed a spec change (args are now required, plus an outputLength), see D313848 and the WPT updates in D310251. Worth pinning to a current Nightly when you test.

//CC @jesup since this is your work.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

expose a TLS key exporter

2 participants