in src/states.js [202:234]
async initialize() {
const keyschedule = this.conn._keyschedule;
await keyschedule.addPSK(this.conn.psk);
// Construct a ClientHello message with our single PSK.
// We can't know the PSK binder value yet, so we initially write zeros.
const clientHello = new ClientHello(
// Client random salt.
await getRandomBytes(32),
// Random legacy_session_id; we *could* send an empty string here,
// but sending a random one makes it easier to be compatible with
// the data emitted by tlslite-ng for test-case generation.
await getRandomBytes(32),
[
new SupportedVersionsExtension([VERSION_TLS_1_3]),
new PskKeyExchangeModesExtension([PSK_MODE_KE]),
new PreSharedKeyExtension([this.conn.pskId], [zeros(HASH_LENGTH)]),
],
);
const buf = new BufferWriter();
clientHello.write(buf);
// Now that we know what the ClientHello looks like,
// go back and calculate the appropriate PSK binder value.
// We only support a single PSK, so the length of the binders field is the
// length of the hash plus one for rendering it as a variable-length byte array,
// plus two for rendering the variable-length list of PSK binders.
const PSK_BINDERS_SIZE = HASH_LENGTH + 1 + 2;
const truncatedTranscript = buf.slice(0, buf.tell() - PSK_BINDERS_SIZE);
const pskBinder = await keyschedule.calculateFinishedMAC(keyschedule.extBinderKey, truncatedTranscript);
buf.incr(-HASH_LENGTH);
buf.writeBytes(pskBinder);
await this.conn._sendHandshakeMessageBytes(buf.flush());
await this.conn._transition(CLIENT_WAIT_SH, clientHello.sessionId);
}