rustls · djc · Jun 23, 2025 · Jun 23, 2025 · Jun 23, 2025 · Jun 23, 2025
diff --git a/rustls/src/client/client_conn.rs b/rustls/src/client/client_conn.rs
@@ -397,6 +397,10 @@ impl ClientConfig {
         danger::DangerousClientConfig { cfg: self }
     }
 
+    pub(super) fn needs_key_share(&self) -> bool {
+        self.supports_version(ProtocolVersion::TLSv1_3)
+    }
+
     /// We support a given TLS version if it's quoted in the configured
     /// versions *and* at least one ciphersuite for this version is
     /// also configured.

diff --git a/rustls/src/client/hs.rs b/rustls/src/client/hs.rs
@@ -114,7 +114,7 @@ pub(super) fn start_handshake(
 
     let mut resuming = find_session(&server_name, &config, cx);
 
-    let key_share = if config.supports_version(ProtocolVersion::TLSv1_3) {
+    let key_share = if config.needs_key_share() {
         Some(tls13::initial_key_share(
             &config,
             &server_name,
@@ -221,17 +221,17 @@ struct ExpectServerHelloOrHelloRetryRequest {
     extra_exts: ClientExtensionsInput<'static>,
 }
 
-struct ClientHelloInput {
-    config: Arc<ClientConfig>,
-    resuming: Option<persist::Retrieved<ClientSessionValue>>,
-    random: Random,
+pub(super) struct ClientHelloInput {
+    pub(super) config: Arc<ClientConfig>,
+    pub(super) resuming: Option<persist::Retrieved<ClientSessionValue>>,
+    pub(super) random: Random,
     #[cfg(feature = "tls12")]
-    using_ems: bool,
-    sent_tls13_fake_ccs: bool,
-    hello: ClientHelloDetails,
-    session_id: SessionId,
-    server_name: ServerName<'static>,
-    prev_ech_ext: Option<EncryptedClientHello>,
+    pub(super) using_ems: bool,
+    pub(super) sent_tls13_fake_ccs: bool,
+    pub(super) hello: ClientHelloDetails,
+    pub(super) session_id: SessionId,
+    pub(super) server_name: ServerName<'static>,
+    pub(super) prev_ech_ext: Option<EncryptedClientHello>,
 }
 
 /// Emits the initial ClientHello or a ClientHello in response to
@@ -548,7 +548,7 @@ fn emit_client_hello_for_retry(
             tls13::derive_early_traffic_secret(
                 &*config.key_log,
                 cx,
-                resuming_suite,
+                resuming_suite.common.hash_provider,
                 &schedule,
                 &mut input.sent_tls13_fake_ccs,
                 transcript_buffer,
@@ -859,32 +859,18 @@ impl State<ClientConnectionData> for ExpectServerHello {
         // handshake_traffic_secret.
         match suite {
             SupportedCipherSuite::Tls13(suite) => {
-                #[allow(clippy::bind_instead_of_map)]
-                let resuming_session = self
-                    .input
-                    .resuming
-                    .and_then(|resuming| match resuming.value {
-                        ClientSessionValue::Tls13(inner) => Some(inner),
-                        #[cfg(feature = "tls12")]
-                        ClientSessionValue::Tls12(_) => None,
-                    });
-
                 tls13::handle_server_hello(
-                    self.input.config,
                     cx,
                     server_hello,
-                    resuming_session,
-                    self.input.server_name,
                     randoms,
                     suite,
                     transcript,
                     self.early_data_key_schedule,
-                    self.input.hello,
                     // We always send a key share when TLS 1.3 is enabled.
                     self.offered_key_share.unwrap(),
-                    self.input.sent_tls13_fake_ccs,
                     &m,
                     self.ech_state,
+                    self.input,
                 )
             }
             #[cfg(feature = "tls12")]
@@ -1176,7 +1162,7 @@ fn process_cert_type_extension(
     }
 }
 
-enum ClientSessionValue {
+pub(super) enum ClientSessionValue {
     Tls13(persist::Tls13ClientSessionValue),
     #[cfg(feature = "tls12")]
     Tls12(persist::Tls12ClientSessionValue),

diff --git a/rustls/src/client/tls13.rs b/rustls/src/client/tls13.rs
@@ -6,7 +6,7 @@ use pki_types::ServerName;
 use subtle::ConstantTimeEq;
 
 use super::client_conn::ClientConnectionData;
-use super::hs::ClientContext;
+use super::hs::{ClientContext, ClientHelloInput, ClientSessionValue};
 use crate::check::inappropriate_handshake_message;
 use crate::client::common::{ClientAuthDetails, ClientHelloDetails, ServerCertDetails};
 use crate::client::ech::{self, EchState, EchStatus};
@@ -16,6 +16,7 @@ use crate::common_state::{
 };
 use crate::conn::ConnectionRandoms;
 use crate::conn::kernel::{Direction, KernelContext, KernelState};
+use crate::crypto::hash::Hash;
 use crate::crypto::{ActiveKeyExchange, SharedSecret};
 use crate::enums::{
     AlertDescription, ContentType, HandshakeType, ProtocolVersion, SignatureScheme,
@@ -34,7 +35,7 @@ use crate::msgs::handshake::{
     ServerHelloPayload,
 };
 use crate::msgs::message::{Message, MessagePayload};
-use crate::msgs::persist;
+use crate::msgs::persist::{self, Retrieved};
 use crate::sign::{CertifiedKey, Signer};
 use crate::suites::PartiallyExtractedSecrets;
 use crate::sync::Arc;
@@ -67,20 +68,16 @@ static DISALLOWED_TLS13_EXTS: &[ExtensionType] = &[
 /// `early_data_key_schedule` is `Some` if we sent the
 /// "early_data" extension to the server.
 pub(super) fn handle_server_hello(
-    config: Arc<ClientConfig>,
     cx: &mut ClientContext<'_>,
     server_hello: &ServerHelloPayload,
-    mut resuming_session: Option<persist::Tls13ClientSessionValue>,
-    server_name: ServerName<'static>,
     mut randoms: ConnectionRandoms,
     suite: &'static Tls13CipherSuite,
     mut transcript: HandshakeHash,
     early_data_key_schedule: Option<KeyScheduleEarly>,
-    mut hello: ClientHelloDetails,
     our_key_share: Box<dyn ActiveKeyExchange>,
-    mut sent_tls13_fake_ccs: bool,
     server_hello_msg: &Message<'_>,
     ech_state: Option<EchState>,
+    input: ClientHelloInput,
 ) -> hs::NextStateOrError<'static> {
     validate_server_hello(cx.common, server_hello)?;
 
@@ -94,6 +91,23 @@ pub(super) fn handle_server_hello(
             )
         })?;
 
+    let ClientHelloInput {
+        config,
+        resuming,
+        mut sent_tls13_fake_ccs,
+        mut hello,
+        server_name,
+        ..
+    } = input;
+
+    let mut resuming_session = match resuming {
+        Some(Retrieved {
+            value: ClientSessionValue::Tls13(value),
+            ..
+        }) => Some(value),
+        _ => None,
+    };
+
     let our_key_share = KeyExchangeChoice::new(&config, cx, our_key_share, their_key_share)
         .map_err(|_| {
             cx.common.send_fatal_alert(
@@ -347,7 +361,7 @@ pub(super) fn fill_in_psk_binder(
 pub(super) fn prepare_resumption(
     config: &ClientConfig,
     cx: &mut ClientContext<'_>,
-    resuming_session: &persist::Retrieved<&persist::Tls13ClientSessionValue>,
+    resuming_session: &Retrieved<&persist::Tls13ClientSessionValue>,
     exts: &mut ClientExtensions<'_>,
     doing_retry: bool,
 ) {
@@ -385,7 +399,7 @@ pub(super) fn prepare_resumption(
 pub(super) fn derive_early_traffic_secret(
     key_log: &dyn KeyLog,
     cx: &mut ClientContext<'_>,
-    resuming_suite: &'static Tls13CipherSuite,
+    hash_alg: &'static dyn Hash,
     early_key_schedule: &KeyScheduleEarly,
     sent_tls13_fake_ccs: &mut bool,
     transcript_buffer: &HandshakeHashBuffer,
@@ -394,7 +408,7 @@ pub(super) fn derive_early_traffic_secret(
     // For middlebox compatibility
     emit_fake_ccs(sent_tls13_fake_ccs, cx.common);
 
-    let client_hello_hash = transcript_buffer.hash_given(resuming_suite.common.hash_provider, &[]);
+    let client_hello_hash = transcript_buffer.hash_given(hash_alg, &[]);
     early_key_schedule.client_early_traffic_secret(
         &client_hello_hash,
         key_log,