golangで作るTLS1.3プロトコル

	     0
             |
             v
   PSK ->  HKDF-Extract = Early Secret

early_secret = HKDF-Extract(0,0)

      v
Derive-Secret(., "derived", "")

derive_secret = Derive-Secret(early_secret, "derived", "")

   (EC)DHE -> HKDF-Extract = Handshake Secret

handshake_secret = HKDF-Extract(dhe, derive_secret)

derive_secret = Derive-Secret(handshake_secret, "derived", "")

0 -> HKDF-Extract = Master Secret

master_secret = HKDF-Extract(0, derive_secret)

(EC)DHE -> HKDF-Extract = Handshake Secret
           |
ここ　→	 +-----> Derive-Secret(., "c hs traffic",
           |                     ClientHello...ServerHello)
           |                     = client_handshake_traffic_secret

client_handshake_traffic_secret = Derive-Secret(handshake_secret, "c hs traffic", ClientHello+ServerHelloメッセージ)

	  HKDF-Expand-Label(Secret, Label, Context, Length) =
            HKDF-Expand(Secret, HkdfLabel, Length)
            
	   struct {
           uint16 length = Length;
           opaque label<7..255> = "tls13 " + Label;
           opaque context<0..255> = Context;
       } HkdfLabel;
        
       Derive-Secret(Secret, Label, Messages) =
            HKDF-Expand-Label(Secret, Label,
                              Transcript-Hash(Messages), Hash.length)

func hkdfExpand(secret, hkdflabel []byte, length int) []byte {
	hash := sha256.New
	expand := hkdf.Expand(hash, secret, hkdflabel)
	b := make([]byte, length)
	io.ReadFull(expand, b)

	return b
}

func hkdfExpandLabel(secret, label, ctx []byte, length int) []byte {
	// labelを作成
	tlslabel := []byte(`tls13 `)
	tlslabel = append(tlslabel, label...)

	// lengthをセット
	hkdflabel := uintTo2byte(uint16(length))
	hkdflabel = append(hkdflabel, byte(len(tlslabel)))
	hkdflabel = append(hkdflabel, tlslabel...)

	hkdflabel = append(hkdflabel, byte(len(ctx)))
	hkdflabel = append(hkdflabel, ctx...)

	return hkdfExpand(secret, hkdflabel, length)
}

func deriveSecret(secret, label, messages_byte []byte) []byte {
	return hkdfExpandLabel(secret, label, messages_byte, 32)
}

func hkdfExtract(secret, salt []byte) []byte {
	hash := sha256.New
	return hkdf.Extract(hash, secret, salt)
}

トラフィックキーイングマテリアルは、次を使用して入力トラフィックシークレット値から生成されます。

   [sender]_write_key = HKDF-Expand-Label(Secret, "key", "", key_length)
   [sender]_write_iv  = HKDF-Expand-Label(Secret, "iv", "", iv_length)
        
[送信者]は送信側を示します。 各レコードタイプのSecretの値を次の表に示します。

       +-------------------+---------------------------------------+
       | Record Type       | Secret                                |
       +-------------------+---------------------------------------+
       | 0-RTT Application | client_early_traffic_secret           |
       |                   |                                       |
       | Handshake         | [sender]_handshake_traffic_secret     |
       |                   |                                       |
       | Application Data  | [sender]_application_traffic_secret_N |
       +-------------------+---------------------------------------+

func keyscheduleToMasterSecret(sharedkey, handshake_messages []byte) KeyBlockTLS13 {

	zero := noRandomByte(32)
	zerohash := writeHash(nil)
	// 0からearly secretを作成する
	earlySecret := hkdfExtract(zero, zero)

	// {client} derive secret for handshake "tls13 derived"
	derivedSecretForhs := deriveSecret(earlySecret, DerivedLabel, zerohash)
	fmt.Printf("derivedSecretForhs %x\n", derivedSecretForhs)

	// {client} extract secret "handshake":
	handshake_secret := hkdfExtract(sharedkey, derivedSecretForhs)
	fmt.Printf("handshake_secret is : %x\n", handshake_secret)

	hash_messages := writeHash(handshake_messages)
	fmt.Printf("hashed messages is %x\n", hash_messages)

	// {client} derive secret "tls13 c hs traffic":
	chstraffic := deriveSecret(handshake_secret, ClienthsTraffic, hash_messages)
	fmt.Printf("CLIENT_HANDSHAKE_TRAFFIC_SECRET %x %x\n", zero, chstraffic)

	// Finished message用のキー
	clientfinkey := deriveSecret(chstraffic, FinishedLabel, nil)
	//fmt.Printf("clientfinkey is : %x\n", clientfinkey)

	// {client} derive secret "tls13 s hs traffic":
	shstraffic := deriveSecret(handshake_secret, ServerhsTraffic, hash_messages)
	fmt.Printf("SERVER_HANDSHAKE_TRAFFIC_SECRET %x %x\n", zero, shstraffic)

	// Finished message用のキー
	serverfinkey := deriveSecret(shstraffic, FinishedLabel, nil)
	//fmt.Printf("serverfinkey is : %x\n", serverfinkey)

	derivedSecretFormaster := deriveSecret(handshake_secret, DerivedLabel, zerohash)
	fmt.Printf("derivedSecretFormaster is : %x\n", derivedSecretFormaster)

	extractSecretMaster := hkdfExtract(zero, derivedSecretFormaster)
	fmt.Printf("extractSecretMaster is : %x\n", extractSecretMaster)

	// {client} derive write traffic keys for handshake data from server hs traffic:
	// 7.3. トラフィックキーの計算
	clienttraffickey := hkdfExpandLabel(chstraffic, []byte(`key`), nil, 32)
	fmt.Printf("client traffic key is : %x\n", clienttraffickey)

	clienttrafficiv := hkdfExpandLabel(chstraffic, []byte(`iv`), nil, 12)
	fmt.Printf("client traffic iv is : %x\n", clienttrafficiv)

	servertraffickey := hkdfExpandLabel(shstraffic, []byte(`key`), nil, 32)
	fmt.Printf("server traffic key is : %x\n", servertraffickey)

	servertrafficiv := hkdfExpandLabel(shstraffic, []byte(`iv`), nil, 12)
	fmt.Printf("server traffic iv is : %x\n", servertrafficiv)

	return KeyBlockTLS13{
		handshakeSecret:       handshake_secret,
		clientHandshakeSecret: chstraffic,
		clientHandshakeKey:    clienttraffickey,
		clientHandshakeIV:     clienttrafficiv,
		clientFinishedKey:     clientfinkey,
		serverHandshakeSecret: shstraffic,
		serverHandshakeKey:    servertraffickey,
		serverHandshakeIV:     servertrafficiv,
		serverFinishedKey:     serverfinkey,
		masterSecret:          extractSecretMaster,
	}
}

func main() {
	// private key (32 octets): 49 af 42 ba 7f 79 94 85 2d 71 3e f2 78 4b cb ca a7 91 1d e2 6a dc 56 42 cb 63 45 40 e7 ea 50 05
	clientPrivateKey, _ := hex.DecodeString("49af42ba7f7994852d713ef2784bcbcaa7911de26adc5642cb634540e7ea5005")
	// public key (32 octets): c9 82 88 76 11 20 95 fe 66 76 2b db f7 c6 72 e1 56 d6 cc 25 3b 83 3d f1 dd 69 b1 b0 4e 75 1f 0f
	serverPublickKey, _ := hex.DecodeString("c9828876112095fe66762bdbf7c672e156d6cc253b833df1dd69b1b04e751f0f")

	// {client} construct a ClientHello handshake message:
	clienthello := "010000c00303cb34ecb1e78163ba1c38c6dacb196a6dffa21a8d9912ec18a2ef6283024dece7000006130113031302010000910000000b0009000006736572766572ff01000100000a00140012001d0017001800190100010101020103010400230000003300260024001d002099381de560e4bd43d23d8e435a7dbafeb3c06e51c13cae4d5413691e529aaf2c002b0003020304000d0020001e040305030603020308040805080604010501060102010402050206020202002d00020101001c00024001"
	// {server} construct a ServerHello handshake message:
	sererhello := "020000560303a6af06a4121860dc5e6e60249cd34c95930c8ac5cb1434dac155772ed3e2692800130100002e00330024001d0020c9828876112095fe66762bdbf7c672e156d6cc253b833df1dd69b1b04e751f0f002b00020304"

	clientserverhello, _ := hex.DecodeString(clienthello + sererhello)

	sharedkey, _ := curve25519.X25519(clientPrivateKey, serverPublickKey)
	keyscheduleToMasterSecret(sharedkey, clientserverhello)
}

$ go run .
derivedSecretForhs 6f2615a108c702c5678f54fc9dbab69716c076189c48250cebeac3576c3611ba
handshake_secret is : 1dc826e93606aa6fdc0aadc12f741b01046aa6b99f691ed221a9f0ca043fbeac
hashed messages is 860c06edc07858ee8e78f0e7428c58edd6b43f2ca3e6e95f02ed063cf0e1cad8
CLIENT_HANDSHAKE_TRAFFIC_SECRET 0000000000000000000000000000000000000000000000000000000000000000 b3eddb126e067f35a780b3abf45e2d8f3b1a950738f52e9600746a0e27a55a21
SERVER_HANDSHAKE_TRAFFIC_SECRET 0000000000000000000000000000000000000000000000000000000000000000 b67b7d690cc16c4e75e54213cb2d37b4e9c912bcded9105d42befd59d391ad38
serverfinkey is : 008d3b66f816ea559f96b537e885c31fc068bf492c652f01f288a1d8cdc19fc8
derivedSecretFormaster is : 43de77e0c77713859a944db9db2590b53190a65b3ee2e4f12dd7a0bb7ce254b4
extractSecretMaster is : 18df06843d13a08bf2a449844c5f8a478001bc4d4c627984d5a41da8d0402919
client traffic key is : 73bfffe9212112f34b54106f2be9617a394d95c8f360452bd4ef2be66b9d8392
client traffic iv is : 5bd3c71b836e0b76bb73265f
server traffic key is : ac70443f7fe3bdaf568b1dcdb0a7f3fea098bca189c3455ba41fcd9d488348a4
server traffic iv is : 5d313eb2671276ee13000b30

	// Finished message用のキー
	clientfinkey := deriveSecret(chstraffic, FinishedLabel, nil)
	
	// Finished message用のキー
	serverfinkey := deriveSecret(shstraffic, FinishedLabel, nil)

verify_data
   PRF(master_secret, finished_label, Hash(handshake_messages))
      [0..verify_data_length-1];

verify_data =
          HMAC(finished_key,
               Transcript-Hash(Handshake Context,
                               Certificate*, CertificateVerify*))

Finishedメッセージの計算に使用されるキーは、HKDFを使用してセクション4.4で定義されたベースキーから計算されます（セクション7.1を参照）。 具体的には：

   finished_key =
       HKDF-Expand-Label(BaseKey, "finished", "", Hash.length)

	if bytes.Equal(tlsversion, TLS1_2) {
		handshake.Extensions = setTLSExtenstions()
		tlsinfo.MasterSecretInfo.ClientRandom = handshake.Random
	} else {
		// TLS1.3のextensionをセット
		handshake.Extensions, tlsinfo.ECDHEKeys = setTLS13Extension()
	}

func setTLS13Extension() ([]byte, ECDHEKeys) {
	var tlsExtension []byte

	// set length
	tlsExtension = append(tlsExtension, []byte{0x00, 0x6F}...)

	//　status_reqeust
	tlsExtension = append(tlsExtension, []byte{0x00, 0x05, 0x00, 0x05, 0x01, 0x00, 0x00, 0x00, 0x00}...)

	// supported_groups
	tlsExtension = append(tlsExtension, []byte{0x00, 0x0a, 0x00, 0x04, 0x00, 0x02, 0x00, 0x1d}...)

	// ec_point_formats
	tlsExtension = append(tlsExtension, []byte{0x00, 0x0b, 0x00, 0x02, 0x01, 0x00}...)

	// signature_algorithms
	tlsExtension = append(tlsExtension, []byte{
		0x00, 0x0d, 0x00, 0x1a, 0x00, 0x18, 0x08, 0x04,
		0x04, 0x03, 0x08, 0x07, 0x08, 0x05, 0x08, 0x06,
		0x04, 0x01, 0x05, 0x01, 0x06, 0x01, 0x05, 0x03,
		0x06, 0x03, 0x02, 0x01, 0x02, 0x03,
	}...)

	// renagotiation_info
	tlsExtension = append(tlsExtension, []byte{0xff, 0x01, 0x00, 0x01, 0x00}...)
	// signed_certificate_timestamp
	tlsExtension = append(tlsExtension, []byte{0x00, 0x12, 0x00, 0x00}...)
	// supported_versions
	tlsExtension = append(tlsExtension, []byte{0x00, 0x2b, 0x00, 0x03, 0x02, 0x03, 0x04}...)

	// 公開鍵を生成する
	clientkey := genrateClientECDHEKey()

	// key_share, DHEの公開鍵を送る
	tlsExtension = append(tlsExtension, []byte{0x00, 0x33, 0x00, 0x26, 0x00, 0x24}...)
	tlsExtension = append(tlsExtension, uintTo2byte(uint16(tls.X25519))...)

	// keyのLength = 32byte
	tlsExtension = append(tlsExtension, []byte{0x00, 0x20}...)
	// 公開鍵を追加
	tlsExtension = append(tlsExtension, clientkey.publicKey...)

	return tlsExtension, clientkey
}

func genrateClientECDHEKey() ECDHEKeys {
	// 秘密鍵となる32byteの乱数をセット
	//clientPrivateKey := randomByte(curve25519.ScalarSize)
	clientPrivateKey := noRandomByte(32)

	// ClientKeyExchangeでサーバに送る公開鍵を生成
	clientPublicKey, _ := curve25519.X25519(clientPrivateKey, curve25519.Basepoint)

	return ECDHEKeys{
		privateKey: clientPrivateKey,
		publicKey:  clientPublicKey,
	}
}

		else {
			hello := ServerHello{
				HandshakeType:     packet[0:1],
				Length:            packet[1:4],
				Version:           packet[4:6],
				Random:            packet[6:38],
				SessionIDLength:   packet[38:39],
				SessionID:         packet[39:71],
				CipherSuites:      packet[71:73],
				CompressionMethod: packet[73:74],
				ExtensionLength:   packet[74:76],
			}
			// supported_versions
			hello.TLSExtensions = append(hello.TLSExtensions, TLSExtensions{
				Type:   packet[76:78],
				Length: packet[78:80],
				Value:  packet[80:82],
			})
			//key_share
			hello.TLSExtensions = append(hello.TLSExtensions, TLSExtensions{
				Type:   packet[82:84],
				Length: packet[84:86],
				Value: map[string]interface{}{
					"Group":             packet[86:88],
					"KeyExchangeLength": packet[88:90],
					"KeyExchange":       packet[90:122],
				},
			})
			i = hello
		}

// TLS1.3用に追加
	case HandshakeTypeEncryptedExtensions:
		i = EncryptedExtensions{
			HandshakeType:   packet[0:1],
			Length:          packet[1:4],
			ExtensionLength: packet[4:6],
		}
		fmt.Printf("EncryptedExtensions : %+v\n", i)
	// TLS1.3用に追加
	case HandshakeTypeCertificateVerify:
		i = CertificateVerify{
			HandshakeType:           packet[0:1],
			Length:                  packet[1:4],
			SignatureHashAlgorithms: packet[4:6],
			SignatureLength:         packet[6:8],
			Signature:               packet[8:],
		}
		fmt.Printf("CertificateVerify : %+v\n", i)
	// TLS1.3用に追加
	case HandshakeTypeFinished:
		i = FinishedMessage{
			HandshakeType: packet[0:1],
			Length:        packet[1:4],
			VerifyData:    packet[4:],
		}
		fmt.Printf("FinishedMessage : %+v\n", i)
	// TLS1.3用に追加
	case HandshakeTypeNewSessionTicket:
		ticketLength := binary.BigEndian.Uint16(packet[21:23]) + 23
		i = SessionTicket{
			HandshakeType:     packet[0:1],
			Length:            packet[1:4],
			TicketLifeTime:    packet[4:8],
			TicketAgeAdd:      packet[8:12],
			TicketNonceLength: packet[12:13],
			TicketNonce:       packet[13:21],
			TicketLength:      packet[21:23],
			Ticket:            packet[23:ticketLength],
			TicketExtensions:  packet[ticketLength:],
		}
		fmt.Printf("SessionTicket : %+v\n", i)
	}

4.4.3. Certificate Verify
デジタル署名は、次の連結を介して計算されます。

- 64回繰り返されるオクテット32（0x20）で構成される文字列
- コンテキスト文字列
- セパレータとして機能する単一の0バイト
- 署名するコンテンツ

The context string for a server signature is "TLS 1.3, server CertificateVerify". The context string for a client signature is "TLS 1.3, client CertificateVerify". It is used to provide separation between signatures made in different contexts, helping against potential cross-protocol attacks.

For example, if the transcript hash was 32 bytes of 01 (this length would make sense for SHA-256), the content covered by the digital signature for a server CertificateVerify would be:

      2020202020202020202020202020202020202020202020202020202020202020
      2020202020202020202020202020202020202020202020202020202020202020
      544c5320312e332c20736572766572204365727469666963617465566572696679
      00
      0101010101010101010101010101010101010101010101010101010101010101

func verifyServerCertificate(pubkey *rsa.PublicKey, signature, handshake_messages []byte) {
	hash_messages := writeHash(handshake_messages)

	hasher := sha256.New()
	// 64回繰り返されるオクテット32（0x20）で構成される文字列
	hasher.Write(strtoByte(str0x20x64))
	// コンテキスト文字列 = "TLS 1.3, server CertificateVerify"
	hasher.Write(serverCertificateContextString)
	// セパレータとして機能する単一の0バイト
	hasher.Write([]byte{0x00})
	hasher.Write(hash_messages)
	signed := hasher.Sum(nil)
	fmt.Printf("hash_messages is %x, signed is %x\n", hash_messages, signed)

	signOpts := &rsa.PSSOptions{SaltLength: rsa.PSSSaltLengthEqualsHash}
	err := rsa.VerifyPSS(pubkey, crypto.SHA256, signed, signature, signOpts)
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println("Server Certificate Verify is OK !!")
}

func encryptChacha20(message []byte, tlsinfo TLSInfo) []byte {
	var key, iv, nonce []byte

	// Finishedメッセージを送るとき
	if tlsinfo.State == ContentTypeHandShake {
		key = tlsinfo.KeyBlockTLS13.clientHandshakeKey
		iv = tlsinfo.KeyBlockTLS13.clientHandshakeIV
		nonce = getNonce(tlsinfo.ClientHandshakeSeq, 8)
	} else {
		// Application Dataを送る時
		key = tlsinfo.KeyBlockTLS13.clientAppKey
		iv = tlsinfo.KeyBlockTLS13.clientAppIV
		nonce = getNonce(tlsinfo.ClientAppSeq, 8)
	}

	fmt.Printf("key is %x, iv is %x\n", key, iv)

	aead, err := chacha20poly1305.New(key)
	if err != nil {
		log.Fatal(err)
	}
	// ivとnonceをxorのbit演算をする
	// 5.3. レコードごとのノンス
	// 2.埋め込まれたシーケンス番号は、静的なclient_write_ivまたはserver_write_iv（役割に応じて）とXORされます。
	xornonce := getXORNonce(nonce, iv)
	header := strtoByte("170303")
	// 平文→暗号化したときのOverHeadを足す
	totalLength := len(message) + 16

	header = append(header, uintTo2byte(uint16(totalLength))...)

	fmt.Printf("encrypt now nonce is %x xornonce is %x, plaintext is %x, add is %x\n", nonce, xornonce, message, header)
	ciphertext := aead.Seal(header, xornonce, message, header)

	return ciphertext
}

events{
}
http{
    server {
        server_name localhost; 
        listen 443 ssl;
        ssl_certificate /etc/certs/my-tls.pem;
        ssl_certificate_key /etc/certs/my-tls-key.pem; 
        ssl_protocols TLSV1.2 TLSv1.3;
        ssl_prefer_server_ciphers on;
        ssl_ciphers AES128-GCM-SHA256,ECDHE-RSA-AES128-GCM-SHA256,ECDHE-RSA-CHACHA20-POLY1305;
        location / {
            root   /usr/share/nginx/html;
            index  index.html index.htm;
        }
    }
}

func main() {

	sock := NewSockStreemSocket()
	addr := setSockAddrInet4(iptobyte(LOCALIP), LOCALPORT)
	err := syscall.Connect(sock, &addr)
	if err != nil {
		log.Fatalf("connect err : %v\n", err)
	}

	var hello ClientHello
	// ClientHelloメッセージを作成
	tlsinfo, hellobyte := hello.NewClientHello(TLS1_3)
	// メッセージを送信
	syscall.Write(sock, hellobyte)

	var packet []byte
	// ServerHello, ChangeCipherSpec, EncryptedExtensions, Certificate, CertificateVerify, Finishedを受信する
	for {
		recvBuf := make([]byte, 2000)
		n, _, err := syscall.Recvfrom(sock, recvBuf, 0)
		if err != nil {
			log.Fatalf("read err : %v", err)
		}
		packet = recvBuf[0:n]
		break
	}

	// read ServerHello
	length := binary.BigEndian.Uint16(packet[3:5]) + 5
	serverhello := parseTLSHandshake(packet[5:length], TLS1_3).(ServerHello)
	serverkeyshare := serverhello.TLSExtensions[1].Value.(map[string]interface{})["KeyExchange"]

	// Serverhelloをmessageに入れておく
	tlsinfo.Handshakemessages = append(tlsinfo.Handshakemessages, packet[5:length]...)
	tlsinfo.State = ContentTypeHandShake
	
	fmt.Printf("server key share is %x\n", serverkeyshare.([]byte))
	//クライアントの秘密鍵とサーバの公開鍵で共通鍵を生成する
	sharedkey, _ := curve25519.X25519(tlsinfo.ECDHEKeys.privateKey, serverkeyshare.([]byte))
	fmt.Printf("sharedkey is %x\n", sharedkey)

	tlsinfo.KeyBlockTLS13 = keyscheduleToMasterSecret(sharedkey, tlsinfo.Handshakemessages)

	copy(packet, packet[length:])

	// read ChangeCipherSpec
	changecipherspec := packet[0:6]
	fmt.Printf("read ChangeCipherSpec is %x, これから暗号化やでー\n", changecipherspec)
	copy(packet, packet[6:])

	hanshake := bytes.Split(packet, []byte{0x17, 0x03, 0x03})
	var pubkey *rsa.PublicKey
exit_loop:
	for _, v := range hanshake {
		if len(v) != 0 {
			v = append([]byte{0x17, 0x03, 0x03}, v...)
			length := binary.BigEndian.Uint16(v[3:5]) + 5

			plaintext := decryptChacha20(v[0:length], tlsinfo)
			i := parseTLSHandshake(plaintext[0:len(plaintext)-1], TLS1_3)

			switch proto := i.(type) {
			case ServerCertificate:
				pubkey = proto.Certificates[0].PublicKey.(*rsa.PublicKey)
			case CertificateVerify:
				verifyServerCertificate(pubkey, proto.Signature, tlsinfo.Handshakemessages)
			case FinishedMessage:
				key := tlsinfo.KeyBlockTLS13.serverFinishedKey
				mac := hmac.New(sha256.New, key)
				mac.Write(writeHash(tlsinfo.Handshakemessages))
				verifydata := mac.Sum(nil)
				if bytes.Equal(verifydata, plaintext[4:len(plaintext)-1]) {
					fmt.Println("Server Verify data is correct !!")
					tlsinfo.ServerHandshakeSeq++
					tlsinfo.Handshakemessages = append(tlsinfo.Handshakemessages, plaintext[0:len(plaintext)-1]...)
					break exit_loop
				} else {
					// 4.4.4. Finished 
					// 本当はdecrypt_errorを送る必要があるのでほんとはだめ
					log.Fatalf("Server Verify data is incorrect! Handshake is stop!")
				}
			}

			tlsinfo.ServerHandshakeSeq++
			tlsinfo.Handshakemessages = append(tlsinfo.Handshakemessages, plaintext[0:len(plaintext)-1]...)

		}
	}

	// App用のキーを作る
	tlsinfo = keyscheduleToAppTraffic(tlsinfo)

	// ChangeCipherSpecメッセージを作る
	changeCipher := NewChangeCipherSpec()

	key := tlsinfo.KeyBlockTLS13.clientFinishedKey
	mac := hmac.New(sha256.New, key)
	mac.Write(writeHash(tlsinfo.Handshakemessages))
	verifydata := mac.Sum(nil)

	finMessage := []byte{HandshakeTypeFinished}
	finMessage = append(finMessage, uintTo3byte(uint32(len(verifydata)))...)
	finMessage = append(finMessage, verifydata...)
	finMessage = append(finMessage, ContentTypeHandShake)

	fmt.Printf("fin message %x\n", finMessage)

	encryptFinMessage := encryptChacha20(finMessage, tlsinfo)
	fmt.Printf("fin message %x\n", encryptFinMessage)

	var all []byte
	all = append(all, changeCipher...)
	all = append(all, encryptFinMessage...)

	// Finished messageを送る
	syscall.Write(sock, all)
	fmt.Println("send finished message")

	tlsinfo.State = ContentTypeApplicationData
	// HTTPリクエストを作成する
	req := NewHttpGetRequest("/", fmt.Sprintf("%s:%d", LOCALIP, LOCALPORT))
	appData := req.reqtoByteArr(req)
	appData = append(appData, ContentTypeApplicationData)
	encAppData := encryptChacha20(appData, tlsinfo)

	// HTTPSリクエストを送る
	syscall.Write(sock, encAppData)
	tlsinfo.ClientAppSeq++

	fmt.Println("send Application data")
	for {
		recvBuf := make([]byte, 2000)
		_, _, err := syscall.Recvfrom(sock, recvBuf, 0)
		if err != nil {
			log.Fatalf("read err : %v", err)
		}
		length := binary.BigEndian.Uint16(recvBuf[3:5])
		plaintext := decryptChacha20(recvBuf[0:length+5], tlsinfo)
		// Alert(Close notify)が来たらbreakして終了
		if bytes.Equal(plaintext[len(plaintext)-1:], []byte{ContentTypeAlert}) {
			break
		} else if bytes.Equal(plaintext[len(plaintext)-1:], []byte{ContentTypeApplicationData}) {
			fmt.Printf("\nplaintext is %s\n", string(plaintext[0:len(plaintext)-1]))
		}
		tlsinfo.ServerAppSeq++
	}
}

$ go run .
ServerHello : {HandshakeType:[2] Length:[0 0 118] Version:[3 3] Random:[35 61 131 243 101 157 71 42 222 75 113 187 84 155 144 248 244 165 243 155 128 229 217 18 60 225 179 58 63 23 38 44] SessionIDLength:[32] SessionID:[0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0] CipherSuites:[19 3] CompressionMethod:[0] ExtensionLength:[0 46] TLSExtensions:[{Type:[0 43] Length:[0 2] Value:[3 4]} {Type:[0 51] Length:[0 36] Value:map[Group:[0 29] KeyExchange:[178 35 114 157 228 46 96 208 162 74 160 117 98 51 183 196 51 82 184 186 151 34 80 96 201 233 118 159 141 234 111 127] KeyExchangeLength:[0 32]]}]}
server key share is b223729de42e60d0a24aa0756233b7c43352b8ba97225060c9e9769f8dea6f7f
sharedkey is a960f4a1b75f08e25243949761a2eac93f5bd46686d45d10a7b7b7869a368a08
derivedSecretForhs 6f2615a108c702c5678f54fc9dbab69716c076189c48250cebeac3576c3611ba
handshake_secret is : 4f4d481f3c9bb75e1d5ab6f39189264eaa80fc306dfb00b83749ea719cb53bbf
hashed messages is b6ea7f03ad2b83b8837eaa3576c61c65a9678613caf9adb1e14f5066998e5844
CLIENT_HANDSHAKE_TRAFFIC_SECRET 0000000000000000000000000000000000000000000000000000000000000000 7feb0aaad0d6c30aff2f655e0a6837447fc22191009a726a7bc417c1f1e07512
SERVER_HANDSHAKE_TRAFFIC_SECRET 0000000000000000000000000000000000000000000000000000000000000000 00d875582c4a8b66e47bccd66f0bb1dccfc5df4d02f434cffe224650b470c01c
serverfinkey is : 39380bcaa3f23a50807d23a4cfa275d73fc78c212ef02a14b6b33c29a1eb751f
derivedSecretFormaster is : cf9443ee4f87a97fc67fd241cb1a4b342c33140895567d8a8605ef3227632b53
extractSecretMaster is : f82ebbadd8f7975874817aaedd420f16be5d22fa69d3fa369bef01ea3ce63c9b
client traffic key is : e150b9107770675165b6a8bd61dc6b513bd7c4851b2cc7bb49b524a841d9236d
client traffic iv is : 292cfde70da79c45a6e9f61b
server traffic key is : 309db84b0b432c9477c12156048ae242e9046c3fde7f7f35b20282928d92c8c2
server traffic iv is : 6f45a0b388fd72baba335d75
read ChangeCipherSpec is 140303000101, これから暗号化するんやでー
EncryptedExtensions : {HandshakeType:[8] Length:[0 0 2] ExtensionLength:[0 0] TLSExtensions:[]}
証明書マジ正しい！
Certificate : {HandshakeType:[11] Length:[0 4 36] CertificatesRequestContextLength:[0] CertificatesLength:[0 4 32] Certificates:[0xc0000c0580]}
CertificateVerify : {HandshakeType:[15] Length:[0 1 4] SignatureHashAlgorithms:[8 4] SignatureLength:[1 0] Signature:[21 176 138 110 163 212 253 176 10 186 173 37 214 164 220 254 97 28 241 249 5 192 17 102 85 100 26 217 42 132 127 184 89 93 67 66 168 231 164 227 166 7 228 189 81 53 51 76 236 61 231 247 187 156 86 53 221 232 6 99 245 177 188 169 173 249 62 104 236 16 89 205 5 123 213 30 40 234 161 252 174 218 253 142 126 238 53 242 224 93 131 66 166 67 27 137 223 184 213 224 211 163 181 183 70 156 170 128 52 5 202 219 73 63 244 220 91 148 101 110 58 22 199 107 129 202 112 127 127 179 184 89 18 9 98 249 27 133 240 88 189 217 139 35 181 162 165 243 30 250 64 35 49 235 214 59 38 124 72 86 135 90 48 72 195 181 190 151 49 41 135 132 224 209 6 27 99 239 156 201 208 61 234 153 183 230 74 66 142 143 109 75 200 214 69 68 78 150 90 175 147 69 99 20 225 252 6 160 189 195 207 123 46 44 128 229 50 135 98 162 8 71 4 167 25 62 249 165 186 98 142 66 120 136 120 156 242 31 203 214 86 165 12 93 168 243 61 38 215 163 190 119 39 148 48 188]}
hash_messages is 1d5b4e95a77fe7b9034661011ab2b5d422276ecb35e213d1a3bc90cf9bb560d6, signed is 40e694b6014cf16b2eaaff84ece2bdb618539e49c5a6a21f5a54e2f3680adbbd
Server Certificate Verify is OK !!
FinishedMessage : {HandshakeType:[20] Length:[0 0 32] VerifyData:[136 69 176 231 172 96 48 241 81 67 31 26 142 156 142 61 135 237 214 6 98 237 192 70 206 159 246 124 30 230 137 59]}
Server Verify data is correct !!
hashed messages is 331399637c93f0afc9bb5d451e036cd6431f9aa718f16af5d82743be450dbb39
CLIENT_TRAFFIC_SECRET_0 0000000000000000000000000000000000000000000000000000000000000000 ec06d4e6b3b9fedaa0125867a6809dcf8c76e362db3d34036d58bd5909e7bea5
SERVER_TRAFFIC_SECRET_0 0000000000000000000000000000000000000000000000000000000000000000 b385a5a205f3fe1ecf504f005e97ab1c3401b7416948b66bc4f6293595d7c0dd
clientAppKey and IV is : 8209132454ead35bea0b7101c0fa7c4c15e6ed758ada375f488dbd6ffe4ac0f2, 7b999ad753d76b5fa809166e
serverAppkey and IV is : 709b44afe0ffa5cb0d5ccc1f869c9dd98b6b062f2a61c46e645df6df002597c2, de68a2db65332b5ee87fcec9
fin message 14000020e24aa09b482fc3bfec10b8ef7c97af853f05966198fa67cb01a328673a268c3e16
key is e150b9107770675165b6a8bd61dc6b513bd7c4851b2cc7bb49b524a841d9236d, iv is 292cfde70da79c45a6e9f61b
encrypt now nonce is 0000000000000000 xornonce is 292cfde70da79c45a6e9f61b, plaintext is 14000020e24aa09b482fc3bfec10b8ef7c97af853f05966198fa67cb01a328673a268c3e16, add is 1703030035
fin message 1703030035b273a2e486118aa4787d1c00c499ee4311351be3ab94a2fcbc494b393443aa2c3e9271579f5513802423d6a901f933880f4a09caab
send finished message
key is 8209132454ead35bea0b7101c0fa7c4c15e6ed758ada375f488dbd6ffe4ac0f2, iv is 7b999ad753d76b5fa809166e
encrypt now nonce is 0000000000000000 xornonce is 7b999ad753d76b5fa809166e, plaintext is 474554202f20485454502f312e310d0a486f73743a203132372e302e302e313a383434330d0a557365722d4167656e743a206375726c2f372e36382e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a17, add is 1703030072
send Application data

plaintext is HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Fri, 06 May 2022 11:43:57 GMT
Content-Type: text/html
Content-Length: 615
Last-Modified: Tue, 25 Jan 2022 15:03:52 GMT
Connection: close
ETag: "61f01158-267"
Accept-Ranges: bytes

<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
html { color-scheme: light dark; }
body { width: 35em; margin: 0 auto;
font-family: Tahoma, Verdana, Arial, sans-serif; }
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>