Skip to content

privasys-v0.5.1-go1.26.5 — RA-TLS challenge-response + session channel binding

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Jul 13:40
privasys-v0.5.1-go1.26.5
This tag was signed with the committer’s verified signature.
bfoing Bertrand
GPG key ID: DA779ED9E4983CFB
Verified
Learn about vigilant mode.
00a7d21
This commit was signed with the committer’s verified signature.
bfoing Bertrand
GPG key ID: DA779ED9E4983CFB
Verified
Learn about vigilant mode.

Go 1.26.5 plus the Privasys RA-TLS extensions in crypto/tls, as two commits on top of upstream release-branch.go1.26 (see the fork README for the full API and usage):

RA-TLS challenge extension 0xFFBB

  • ClientHello leg: Config.RATLSChallenge (client) sends a challenge nonce; the server reads it via ClientHelloInfo.RATLSChallenge in its certificate callbacks.
  • CertificateRequest leg: Config.RATLSChallenge (server) sends the nonce to the client; GetClientCertificate receives it via CertificateRequestInfo.RATLSChallenge.

Session channel binding (CVE-2026-33697 class relay defence)

  • A 32-byte channel binder is derived from the TLS 1.3 key schedule: HKDF-Expand-Label(client_handshake_traffic_secret, "privasys-ratls-binder-v1", transcript-through-ServerHello, 32) — identical on both peers, byte-compatible with the Privasys rustls fork, no negotiation.
  • Server leg: Config.RATLSBindCertificate re-mints the server leaf at the Certificate-emit seam so its quote's report_data commits to this exact session. Servers that serve certificates through GetCertificate (certmagic/Caddy) instead get a second GetCertificate call with ClientHelloInfo.RATLSChannelBinder set, only for clients that sent 0xFFBB.
  • Mutual (client-cert) leg: CertificateRequestInfo.RATLSChannelBinder gives the client the binder so its client cert's quote commits to the session; a relayed identity fails closed against a binding-aware verifier.
  • ConnectionState.RATLSChannelBinder exposes the binder on both sides.

Tests

TestRATLS* in crypto/tls: binder equality across the handshake, GetCertificate re-invocation, both challenge legs reaching their callbacks byte-for-byte, bind-hook cert re-mint on the wire, TLS 1.2 fail-closed, and extension marshal round-trips. Full crypto/tls suite green.

Toolchain

go-ratls-privasys-v0.5.1-go1.26.5-linux-amd64.tar.gz is a prebuilt linux-amd64 toolchain. Build with GOROOT=<extracted>/go-ratls go build -tags ratls.

Supersedes earlier privasys-v0.x tags (rebased history).

Assets 3
Loading