/* TLS 1.3 Key Schedule (RFC 8446 §7.1) */
/* All derivations use HKDF with the negotiated hash (SHA-256 or SHA-384) */

0 (Early Secret)
  ├─ Early Traffic Keys (for 0-RTT data, if resuming with PSK)
  │
  ↓ HKDF-Extract(PSK or 0-bytes, Early Secret)
Handshake Secret
  ├─ client_handshake_traffic_secret
  │   → client_handshake_key (AES key for client→server during handshake)
  │   → client_handshake_iv  (nonce base)
  ├─ server_handshake_traffic_secret
  │   → server_handshake_key (AES key for server→client during handshake)
  │   → server_handshake_iv
  │
  ↓ HKDF-Extract(ECDHE shared secret, Handshake Secret)
Master Secret
  ├─ client_application_traffic_secret_0
  │   → client_write_key (AES key for client→server application data)
  │   → client_write_iv
  ├─ server_application_traffic_secret_0
  │   → server_write_key (AES key for server→client application data)
  │   → server_write_iv
  ├─ exporter_master_secret (for channel binding)
  └─ resumption_master_secret (for session tickets / PSK resumption)

/* Nonce construction — prevents nonce reuse */
/* For each record: nonce = write_iv XOR sequence_number (64-bit, left-padded) */
/* Sequence number increments with each record → unique nonce per record */

/* Key update (post-handshake) */
/* Either side can send KeyUpdate message → derive new traffic keys */
new_secret = HKDF-Expand-Label(current_secret, "traffic upd", "", hash_len)
/* Forward secrecy within a session: old keys deleted, new keys derived */

/* Standard TLS: only server is authenticated */
/* mTLS (mutual TLS): both server AND client present certificates */

/* mTLS handshake additions */
After sending Certificate + CertificateVerify + Finished, server sends:
  CertificateRequest: list of acceptable CA DNs for client certificates

Client responds with:
  Certificate: client's X.509 certificate (or empty if none available)
  CertificateVerify: signature over handshake transcript with client private key
  Finished: as normal

/* Use cases for mTLS */
Service mesh (Istio, Linkerd): all microservices authenticate each other
Zero-trust networks: every connection requires client cert (device identity)
API security: client apps authenticate with cert instead of API keys
IoT devices: device certificates for mutual auth to backend
NGFW policy: require client cert for access to sensitive internal resources

/* Configure nginx for mTLS */
ssl_client_certificate /etc/ssl/ca.pem;  # CA that signed client certs
ssl_verify_client on;                     # require client cert
ssl_verify_depth 2;                       # allow one intermediate CA

/* OpenSSL mTLS server in C */
SSL_CTX *ctx = SSL_CTX_new(TLS_server_method());
SSL_CTX_load_verify_locations(ctx, "ca.pem", NULL);
SSL_CTX_use_certificate_file(ctx, "server.pem", SSL_FILETYPE_PEM);
SSL_CTX_use_PrivateKey_file(ctx, "server.key", SSL_FILETYPE_PEM);
SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, NULL);

/* After SSL_accept(): inspect client certificate */
X509 *client_cert = SSL_get_peer_certificate(ssl);
X509_NAME *subj = X509_get_subject_name(client_cert);
char cn[256];
X509_NAME_get_text_by_NID(subj, NID_commonName, cn, sizeof(cn));
printf("Client cert CN: %s\n", cn);
X509_free(client_cert);