[RFC] crypto/tls: advertise PSS support, add tests

PSS signatures in X509 certificates are already supported, and now that handshake messages also support PSS, let's advertise it in the client and enable it for the server. Add test that checks for PSS signatures in (1) handshake messages and (2) certificates. Updates golang#9671 Tested with: go test -race crypto/tls -v -test.run TestHandshakeClientCertRSAPSS -args -update TODO update many other tests since signature_algorithms is updated. RFC force s_server to disable PSS for other tests, and use PKCS#1 v1.5? RFC ok to change tests to require openssl from git? Change-Id: I1b2ce2d13a07f5dda98b918313f3c581ce1d7b1d
Lekensteyn · Nov 23, 2017 · 7b9830d · 7b9830d
1 parent a54da72
commit 7b9830d
Show file tree

Hide file tree

Showing 5 changed files with 164 additions and 3 deletions.
diff --git a/src/crypto/tls/common.go b/src/crypto/tls/common.go
@@ -139,6 +139,9 @@ const (
 // CertificateRequest. The two fields are merged to match with TLS 1.3.
 // Note that in TLS 1.2, the ECDSA algorithms are not constrained to P-256, etc.
 var supportedSignatureAlgorithms = []SignatureScheme{
+	PSSWithSHA256,
+	PSSWithSHA384,
+	PSSWithSHA512,
 	PKCS1WithSHA256,
 	ECDSAWithP256AndSHA256,
 	PKCS1WithSHA384,

diff --git a/src/crypto/tls/handshake_client_test.go b/src/crypto/tls/handshake_client_test.go
@@ -660,6 +660,31 @@ func TestHandshakeClientCertECDSA(t *testing.T) {
 	runClientTestTLS12(t, test)
 }
 
+func TestHandshakeClientCertRSAPSS(t *testing.T) {
+	// self-signed
+	issuer, err := x509.ParseCertificate(testRSAPSSCertificate)
+	if err != nil {
+		panic(err)
+	}
+	rootCAs := x509.NewCertPool()
+	rootCAs.AddCert(issuer)
+
+	config := testConfig.Clone()
+	cert, _ := X509KeyPair([]byte(clientCertificatePEM), []byte(clientKeyPEM))
+	config.Certificates = []Certificate{cert}
+	config.RootCAs = rootCAs
+
+	test := &clientTest{
+		name:    "ClientCert-RSA-RSAPSS",
+		command: []string{"openssl", "s_server", "-cipher", "AES128", "-verify", "1", "-sigalgs", "RSA-PSS+SHA256"},
+		config:  config,
+		cert:    testRSAPSSCertificate,
+		key:     testRSAPrivateKey,
+	}
+
+	runClientTestTLS12(t, test)
+}
+
 func TestClientResumption(t *testing.T) {
 	serverConfig := &Config{
 		CipherSuites: []uint16{TLS_RSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_RC4_128_SHA},

diff --git a/src/crypto/tls/handshake_server_test.go b/src/crypto/tls/handshake_server_test.go
@@ -1080,8 +1080,6 @@ func BenchmarkHandshakeServer(b *testing.B) {
 }
 
 // clientCertificatePEM and clientKeyPEM were generated with generate_cert.go
-// Thus, they have no ExtKeyUsage fields and trigger an error when verification
-// is turned on.
 
 const clientCertificatePEM = `
 -----BEGIN CERTIFICATE-----
@@ -1373,6 +1371,9 @@ func fromHex(s string) []byte {
 
 var testRSACertificate = fromHex("3082024b308201b4a003020102020900e8f09d3fe25beaa6300d06092a864886f70d01010b0500301f310b3009060355040a1302476f3110300e06035504031307476f20526f6f74301e170d3136303130313030303030305a170d3235303130313030303030305a301a310b3009060355040a1302476f310b300906035504031302476f30819f300d06092a864886f70d010101050003818d0030818902818100db467d932e12270648bc062821ab7ec4b6a25dfe1e5245887a3647a5080d92425bc281c0be97799840fb4f6d14fd2b138bc2a52e67d8d4099ed62238b74a0b74732bc234f1d193e596d9747bf3589f6c613cc0b041d4d92b2b2423775b1c3bbd755dce2054cfa163871d1e24c4f31d1a508baab61443ed97a77562f414c852d70203010001a38193308190300e0603551d0f0101ff0404030205a0301d0603551d250416301406082b0601050507030106082b06010505070302300c0603551d130101ff0402300030190603551d0e041204109f91161f43433e49a6de6db680d79f60301b0603551d230414301280104813494d137e1631bba301d5acab6e7b30190603551d1104123010820e6578616d706c652e676f6c616e67300d06092a864886f70d01010b0500038181009d30cc402b5b50a061cbbae55358e1ed8328a9581aa938a495a1ac315a1a84663d43d32dd90bf297dfd320643892243a00bccf9c7db74020015faad3166109a276fd13c3cce10c5ceeb18782f16c04ed73bbb343778d0c1cf10fa1d8408361c94c722b9daedb4606064df4c1b33ec0d1bd42d4dbfe3d1360845c21d33be9fae7")
 
+// uses same private key as testRSACertificate (but is self-signed)
+var testRSAPSSCertificate = fromHex("308202583082018da003020102021100f29926eb87ea8a0db9fcc247347c11b0304106092a864886f70d01010a3034a00f300d06096086480165030402010500a11c301a06092a864886f70d010108300d06096086480165030402010500a20302012030123110300e060355040a130741636d6520436f301e170d3137313132333136313631305a170d3138313132333136313631305a30123110300e060355040a130741636d6520436f30819f300d06092a864886f70d010101050003818d0030818902818100db467d932e12270648bc062821ab7ec4b6a25dfe1e5245887a3647a5080d92425bc281c0be97799840fb4f6d14fd2b138bc2a52e67d8d4099ed62238b74a0b74732bc234f1d193e596d9747bf3589f6c613cc0b041d4d92b2b2423775b1c3bbd755dce2054cfa163871d1e24c4f31d1a508baab61443ed97a77562f414c852d70203010001a3463044300e0603551d0f0101ff0404030205a030130603551d25040c300a06082b06010505070301300c0603551d130101ff04023000300f0603551d110408300687047f000001304106092a864886f70d01010a3034a00f300d06096086480165030402010500a11c301a06092a864886f70d010108300d06096086480165030402010500a20302012003818100cdac4ef2ce5f8d79881042707f7cbf1b5a8a00ef19154b40151771006cd41626e5496d56da0c1a139fd84695593cb67f87765e18aa03ea067522dd78d2a589b8c92364e12838ce346c6e067b51f1a7e6f4b37ffab13f1411896679d18e880e0ba09e302ac067efca460288e9538122692297ad8093d4f7dd701424d7700a46a1")
+
 var testRSACertificateIssuer = fromHex("3082021930820182a003020102020900ca5e4e811a965964300d06092a864886f70d01010b0500301f310b3009060355040a1302476f3110300e06035504031307476f20526f6f74301e170d3136303130313030303030305a170d3235303130313030303030305a301f310b3009060355040a1302476f3110300e06035504031307476f20526f6f7430819f300d06092a864886f70d010101050003818d0030818902818100d667b378bb22f34143b6cd2008236abefaf2852adf3ab05e01329e2c14834f5105df3f3073f99dab5442d45ee5f8f57b0111c8cb682fbb719a86944eebfffef3406206d898b8c1b1887797c9c5006547bb8f00e694b7a063f10839f269f2c34fff7a1f4b21fbcd6bfdfb13ac792d1d11f277b5c5b48600992203059f2a8f8cc50203010001a35d305b300e0603551d0f0101ff040403020204301d0603551d250416301406082b0601050507030106082b06010505070302300f0603551d130101ff040530030101ff30190603551d0e041204104813494d137e1631bba301d5acab6e7b300d06092a864886f70d01010b050003818100c1154b4bab5266221f293766ae4138899bd4c5e36b13cee670ceeaa4cbdf4f6679017e2fe649765af545749fe4249418a56bd38a04b81e261f5ce86b8d5c65413156a50d12449554748c59a30c515bc36a59d38bddf51173e899820b282e40aa78c806526fd184fb6b4cf186ec728edffa585440d2b3225325f7ab580e87dd76")
 
 var testECDSACertificate = fromHex("3082020030820162020900b8bf2d47a0d2ebf4300906072a8648ce3d04013045310b3009060355040613024155311330110603550408130a536f6d652d53746174653121301f060355040a1318496e7465726e6574205769646769747320507479204c7464301e170d3132313132323135303633325a170d3232313132303135303633325a3045310b3009060355040613024155311330110603550408130a536f6d652d53746174653121301f060355040a1318496e7465726e6574205769646769747320507479204c746430819b301006072a8648ce3d020106052b81040023038186000400c4a1edbe98f90b4873367ec316561122f23d53c33b4d213dcd6b75e6f6b0dc9adf26c1bcb287f072327cb3642f1c90bcea6823107efee325c0483a69e0286dd33700ef0462dd0da09c706283d881d36431aa9e9731bd96b068c09b23de76643f1a5c7fe9120e5858b65f70dd9bd8ead5d7f5d5ccb9b69f30665b669a20e227e5bffe3b300906072a8648ce3d040103818c0030818802420188a24febe245c5487d1bacf5ed989dae4770c05e1bb62fbdf1b64db76140d311a2ceee0b7e927eff769dc33b7ea53fcefa10e259ec472d7cacda4e970e15a06fd00242014dfcbe67139c2d050ebd3fa38c25c13313830d9406bbd4377af6ec7ac9862eddd711697f857c56defb31782be4c7780daecbbe9e4e3624317b6a0f399512078f2a")

diff --git a/src/crypto/tls/handshake_test.go b/src/crypto/tls/handshake_test.go
@@ -67,14 +67,17 @@ func testOpenSSLVersion() {
 	}
 
 	version := string(output)
-	if strings.HasPrefix(version, "OpenSSL 1.1.0") {
+	// At minimum "1.1.0" is required, but some tests need "1.1.1"
+	// (commit b2eb699874) which is not yet released.
+	if strings.HasPrefix(version, "OpenSSL 1.1.") {
 		return
 	}
 
 	println("***********************************************")
 	println("")
 	println("You need to build OpenSSL 1.1.0 from source in order")
 	println("to update the test data.")
+	println("TestHandshakeClientCertRSAPSS requires 1.1.1-dev though.")
 	println("")
 	println("Configure it with:")
 	println("./Configure enable-weak-ssl-ciphers enable-ssl3 enable-ssl3-method -static linux-x86_64")

diff --git a/src/crypto/tls/testdata/Client-TLSv12-ClientCert-RSA-RSAPSS b/src/crypto/tls/testdata/Client-TLSv12-ClientCert-RSA-RSAPSS
@@ -0,0 +1,129 @@
+>>> Flow 1 (client to server)
+00000000  16 03 01 00 9b 01 00 00  97 03 03 00 00 00 00 00  |................|
+00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
+00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 2c cc a8  |.............,..|
+00000030  cc a9 c0 2f c0 2b c0 30  c0 2c c0 27 c0 13 c0 23  |.../.+.0.,.'...#|
+00000040  c0 09 c0 14 c0 0a 00 9c  00 9d 00 3c 00 2f 00 35  |...........<./.5|
+00000050  c0 12 00 0a 00 05 c0 11  c0 07 01 00 00 42 00 05  |.............B..|
+00000060  00 05 01 00 00 00 00 00  0a 00 0a 00 08 00 1d 00  |................|
+00000070  17 00 18 00 19 00 0b 00  02 01 00 00 0d 00 18 00  |................|
+00000080  16 08 04 08 05 08 06 04  01 04 03 05 01 05 03 06  |................|
+00000090  01 06 03 02 01 02 03 ff  01 00 01 00 00 12 00 00  |................|
+>>> Flow 2 (server to client)
+00000000  16 03 03 00 59 02 00 00  55 03 03 1b fe e1 c7 8f  |....Y...U.......|
+00000010  67 0c 05 8c 2b 0b 5e eb  07 71 1e 96 91 6d 20 2c  |g...+.^..q...m ,|
+00000020  8e 0f 76 25 bc ae bd 73  fd ba b4 20 94 1a 5d 59  |..v%...s... ..]Y|
+00000030  7e 37 85 3f 49 69 65 22  46 bb ec 21 97 b8 80 bb  |~7.?Iie"F..!....|
+00000040  26 0f 73 ac 74 94 df d4  b3 7e b9 e8 c0 2f 00 00  |&.s.t....~.../..|
+00000050  0d ff 01 00 01 00 00 0b  00 04 03 00 01 02 16 03  |................|
+00000060  03 02 66 0b 00 02 62 00  02 5f 00 02 5c 30 82 02  |..f...b.._..\0..|
+00000070  58 30 82 01 8d a0 03 02  01 02 02 11 00 f2 99 26  |X0.............&|
+00000080  eb 87 ea 8a 0d b9 fc c2  47 34 7c 11 b0 30 41 06  |........G4|..0A.|
+00000090  09 2a 86 48 86 f7 0d 01  01 0a 30 34 a0 0f 30 0d  |.*.H......04..0.|
+000000a0  06 09 60 86 48 01 65 03  04 02 01 05 00 a1 1c 30  |..`.H.e........0|
+000000b0  1a 06 09 2a 86 48 86 f7  0d 01 01 08 30 0d 06 09  |...*.H......0...|
+000000c0  60 86 48 01 65 03 04 02  01 05 00 a2 03 02 01 20  |`.H.e.......... |
+000000d0  30 12 31 10 30 0e 06 03  55 04 0a 13 07 41 63 6d  |0.1.0...U....Acm|
+000000e0  65 20 43 6f 30 1e 17 0d  31 37 31 31 32 33 31 36  |e Co0...17112316|
+000000f0  31 36 31 30 5a 17 0d 31  38 31 31 32 33 31 36 31  |1610Z..181123161|
+00000100  36 31 30 5a 30 12 31 10  30 0e 06 03 55 04 0a 13  |610Z0.1.0...U...|
+00000110  07 41 63 6d 65 20 43 6f  30 81 9f 30 0d 06 09 2a  |.Acme Co0..0...*|
+00000120  86 48 86 f7 0d 01 01 01  05 00 03 81 8d 00 30 81  |.H............0.|
+00000130  89 02 81 81 00 db 46 7d  93 2e 12 27 06 48 bc 06  |......F}...'.H..|
+00000140  28 21 ab 7e c4 b6 a2 5d  fe 1e 52 45 88 7a 36 47  |(!.~...]..RE.z6G|
+00000150  a5 08 0d 92 42 5b c2 81  c0 be 97 79 98 40 fb 4f  |....B[.....y.@.O|
+00000160  6d 14 fd 2b 13 8b c2 a5  2e 67 d8 d4 09 9e d6 22  |m..+.....g....."|
+00000170  38 b7 4a 0b 74 73 2b c2  34 f1 d1 93 e5 96 d9 74  |8.J.ts+.4......t|
+00000180  7b f3 58 9f 6c 61 3c c0  b0 41 d4 d9 2b 2b 24 23  |{.X.la<..A..++$#|
+00000190  77 5b 1c 3b bd 75 5d ce  20 54 cf a1 63 87 1d 1e  |w[.;.u]. T..c...|
+000001a0  24 c4 f3 1d 1a 50 8b aa  b6 14 43 ed 97 a7 75 62  |$....P....C...ub|
+000001b0  f4 14 c8 52 d7 02 03 01  00 01 a3 46 30 44 30 0e  |...R.......F0D0.|
+000001c0  06 03 55 1d 0f 01 01 ff  04 04 03 02 05 a0 30 13  |..U...........0.|
+000001d0  06 03 55 1d 25 04 0c 30  0a 06 08 2b 06 01 05 05  |..U.%..0...+....|
+000001e0  07 03 01 30 0c 06 03 55  1d 13 01 01 ff 04 02 30  |...0...U.......0|
+000001f0  00 30 0f 06 03 55 1d 11  04 08 30 06 87 04 7f 00  |.0...U....0.....|
+00000200  00 01 30 41 06 09 2a 86  48 86 f7 0d 01 01 0a 30  |..0A..*.H......0|
+00000210  34 a0 0f 30 0d 06 09 60  86 48 01 65 03 04 02 01  |4..0...`.H.e....|
+00000220  05 00 a1 1c 30 1a 06 09  2a 86 48 86 f7 0d 01 01  |....0...*.H.....|
+00000230  08 30 0d 06 09 60 86 48  01 65 03 04 02 01 05 00  |.0...`.H.e......|
+00000240  a2 03 02 01 20 03 81 81  00 cd ac 4e f2 ce 5f 8d  |.... ......N.._.|
+00000250  79 88 10 42 70 7f 7c bf  1b 5a 8a 00 ef 19 15 4b  |y..Bp.|..Z.....K|
+00000260  40 15 17 71 00 6c d4 16  26 e5 49 6d 56 da 0c 1a  |@..q.l..&.ImV...|
+00000270  13 9f d8 46 95 59 3c b6  7f 87 76 5e 18 aa 03 ea  |...F.Y<...v^....|
+00000280  06 75 22 dd 78 d2 a5 89  b8 c9 23 64 e1 28 38 ce  |.u".x.....#d.(8.|
+00000290  34 6c 6e 06 7b 51 f1 a7  e6 f4 b3 7f fa b1 3f 14  |4ln.{Q........?.|
+000002a0  11 89 66 79 d1 8e 88 0e  0b a0 9e 30 2a c0 67 ef  |..fy.......0*.g.|
+000002b0  ca 46 02 88 e9 53 81 22  69 22 97 ad 80 93 d4 f7  |.F...S."i"......|
+000002c0  dd 70 14 24 d7 70 0a 46  a1 16 03 03 00 ac 0c 00  |.p.$.p.F........|
+000002d0  00 a8 03 00 1d 20 58 14  b4 43 8d 17 55 0a 51 81  |..... X..C..U.Q.|
+000002e0  9b b1 7a 04 ac 59 50 d8  59 3e 47 ca 55 f4 08 93  |..z..YP.Y>G.U...|
+000002f0  2b 98 40 ea 75 48 08 04  00 80 d1 2d 32 75 dd 70  |+.@.uH.....-2u.p|
+00000300  51 2d e8 c7 43 fd 6e 82  bb cc 35 61 60 4f 41 60  |Q-..C.n...5a`OA`|
+00000310  aa 63 51 fd 3a 01 5d 26  34 bb 8d 3a 83 8c e6 0a  |.cQ.:.]&4..:....|
+00000320  fd f3 f5 65 b8 ec 14 90  a1 21 18 a0 c5 7a fa ac  |...e.....!...z..|
+00000330  62 83 1d 47 12 ac 83 c3  2e 38 e5 27 20 95 d7 7f  |b..G.....8.' ...|
+00000340  aa 9a 7d 7f d7 4c bf 45  e8 7e c4 ee 5b 85 a4 75  |..}..L.E.~..[..u|
+00000350  2e f3 75 47 9e d0 50 20  e2 68 88 ba 2c 5c e5 4f  |..uG..P .h..,\.O|
+00000360  23 7b 9f 1a 07 4f f6 02  c0 d5 63 85 4d 37 a1 03  |#{...O....c.M7..|
+00000370  c2 39 92 f7 0c 9f 5d 84  38 12 16 03 03 00 0c 0d  |.9....].8.......|
+00000380  00 00 08 01 01 00 02 08  04 00 00 16 03 03 00 04  |................|
+00000390  0e 00 00 00                                       |....|
+>>> Flow 3 (client to server)
+00000000  16 03 03 01 fd 0b 00 01  f9 00 01 f6 00 01 f3 30  |...............0|
+00000010  82 01 ef 30 82 01 58 a0  03 02 01 02 02 10 5c 19  |...0..X.......\.|
+00000020  c1 89 65 83 55 6f dc 0b  c9 b9 93 9f e9 bc 30 0d  |..e.Uo........0.|
+00000030  06 09 2a 86 48 86 f7 0d  01 01 0b 05 00 30 12 31  |..*.H........0.1|
+00000040  10 30 0e 06 03 55 04 0a  13 07 41 63 6d 65 20 43  |.0...U....Acme C|
+00000050  6f 30 1e 17 0d 31 36 30  38 31 37 32 31 35 32 33  |o0...16081721523|
+00000060  31 5a 17 0d 31 37 30 38  31 37 32 31 35 32 33 31  |1Z..170817215231|
+00000070  5a 30 12 31 10 30 0e 06  03 55 04 0a 13 07 41 63  |Z0.1.0...U....Ac|
+00000080  6d 65 20 43 6f 30 81 9f  30 0d 06 09 2a 86 48 86  |me Co0..0...*.H.|
+00000090  f7 0d 01 01 01 05 00 03  81 8d 00 30 81 89 02 81  |...........0....|
+000000a0  81 00 ba 6f aa 86 bd cf  bf 9f f2 ef 5c 94 60 78  |...o........\.`x|
+000000b0  6f e8 13 f2 d1 96 6f cd  d9 32 6e 22 37 ce 41 f9  |o.....o..2n"7.A.|
+000000c0  ca 5d 29 ac e1 27 da 61  a2 ee 81 cb 10 c7 df 34  |.])..'.a.......4|
+000000d0  58 95 86 e9 3d 19 e6 5c  27 73 60 c8 8d 78 02 f4  |X...=..\'s`..x..|
+000000e0  1d a4 98 09 a3 19 70 69  3c 25 62 66 2a ab 22 23  |......pi<%bf*."#|
+000000f0  c5 7b 85 38 4f 2e 09 73  32 a7 bd 3e 9b ad ca 84  |.{.8O..s2..>....|
+00000100  07 e6 0f 3a ff 77 c5 9d  41 85 00 8a b6 9b ee b0  |...:.w..A.......|
+00000110  a4 3f 2d 4c 4c e6 42 3e  bb 51 c8 dd 48 54 f4 0c  |.?-LL.B>.Q..HT..|
+00000120  8e 47 02 03 01 00 01 a3  46 30 44 30 0e 06 03 55  |.G......F0D0...U|
+00000130  1d 0f 01 01 ff 04 04 03  02 05 a0 30 13 06 03 55  |...........0...U|
+00000140  1d 25 04 0c 30 0a 06 08  2b 06 01 05 05 07 03 01  |.%..0...+.......|
+00000150  30 0c 06 03 55 1d 13 01  01 ff 04 02 30 00 30 0f  |0...U.......0.0.|
+00000160  06 03 55 1d 11 04 08 30  06 87 04 7f 00 00 01 30  |..U....0.......0|
+00000170  0d 06 09 2a 86 48 86 f7  0d 01 01 0b 05 00 03 81  |...*.H..........|
+00000180  81 00 46 ab 44 a2 fb 28  54 f8 5a 67 f8 62 94 f1  |..F.D..(T.Zg.b..|
+00000190  9a b2 18 9e f2 b1 de 1d  7e 6f 76 95 a9 ba e7 5d  |........~ov....]|
+000001a0  a8 16 6c 9c f7 09 d3 37  e4 4b 2b 36 7c 01 ad 41  |..l....7.K+6|..A|
+000001b0  d2 32 d8 c3 d2 93 f9 10  6b 8e 95 b9 2c 17 8a a3  |.2......k...,...|
+000001c0  44 48 bc 59 13 83 16 04  88 a4 81 5c 25 0d 98 0c  |DH.Y.......\%...|
+000001d0  ac 11 b1 28 56 be 1d cd  61 62 84 09 bf d6 80 c6  |...(V...ab......|
+000001e0  45 8d 82 2c b4 d8 83 9b  db c9 22 b7 2a 12 11 7b  |E..,......".*..{|
+000001f0  fa 02 3b c1 c9 ff ea c9  9d a8 49 d3 95 d7 d5 0e  |..;.......I.....|
+00000200  e5 35 16 03 03 00 25 10  00 00 21 20 2f e5 7d a3  |.5....%...! /.}.|
+00000210  47 cd 62 43 15 28 da ac  5f bb 29 07 30 ff f6 84  |G.bC.(.._.).0...|
+00000220  af c4 cf c2 ed 90 99 5f  58 cb 3b 74 16 03 03 00  |......._X.;t....|
+00000230  88 0f 00 00 84 08 04 00  80 71 3a 47 35 0c 40 85  |.........q:G5.@.|
+00000240  34 6b 2a 89 1a 76 0f e4  32 84 f6 73 7b 71 2a df  |4k*..v..2..s{q*.|
+00000250  dc 06 a6 b9 c2 b7 16 c7  83 4d e4 ef 27 a0 8d 5f  |.........M..'.._|
+00000260  14 4b 4c 7d dc d7 ca b2  69 b9 6c e4 32 20 c8 61  |.KL}....i.l.2 .a|
+00000270  81 2e 8c ce d6 7c 7e b4  59 7f dd a7 fe fb 46 f5  |.....|~.Y.....F.|
+00000280  b8 db a2 9c 2e f5 e2 a0  7d 0e 71 60 05 a9 ab aa  |........}.q`....|
+00000290  cf c2 68 d8 ea 3c 3f a8  60 f0 e6 ce 96 28 de e5  |..h..<?.`....(..|
+000002a0  a1 b3 d6 39 32 4a 6f c1  1d 45 23 17 ff 68 bf 93  |...92Jo..E#..h..|
+000002b0  d1 44 ba bf bf 63 68 3b  7c 14 03 03 00 01 01 16  |.D...ch;|.......|
+000002c0  03 03 00 28 00 00 00 00  00 00 00 00 46 e9 29 8e  |...(........F.).|
+000002d0  09 bb 94 e9 e2 3c 98 23  3e 0b a2 8d d8 82 44 43  |.....<.#>.....DC|
+000002e0  90 73 91 a3 82 89 ba 09  55 10 38 a1              |.s......U.8.|
+>>> Flow 4 (server to client)
+00000000  14 03 03 00 01 01 16 03  03 00 28 80 cc 4d 27 90  |..........(..M'.|
+00000010  17 a0 50 8e 69 9b 65 87  79 ce 72 e4 a1 29 cc 49  |..P.i.e.y.r..).I|
+00000020  36 67 87 b5 de 8d 98 2c  8a dd c0 b1 82 64 e9 ec  |6g.....,.....d..|
+00000030  73 5a 74                                          |sZt|
+>>> Flow 5 (client to server)
+00000000  17 03 03 00 1e 00 00 00  00 00 00 00 01 c8 11 44  |...............D|
+00000010  5f 74 f8 58 d3 e4 4f 6e  27 11 0b 40 a3 2a f4 b3  |_t.X..On'..@.*..|
+00000020  b1 5c 1a 15 03 03 00 1a  00 00 00 00 00 00 00 02  |.\..............|
+00000030  ec fb 4a 59 89 03 39 21  2a 66 d9 c8 16 79 4d 4c  |..JY..9!*f...yML|
+00000040  75 0b                                             |u.|