fix(nix): update vendorHash and vendor dir for new deps

vendor/github.com/quic-go/quic-go/internal/handshake/aead.go

@@ -0,0 +1,90 @@
+package handshake
+
+import (
+	"encoding/binary"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+)
+
+func createAEAD(suite cipherSuite, trafficSecret []byte, v protocol.Version) *xorNonceAEAD {
+	keyLabel := hkdfLabelKeyV1
+	ivLabel := hkdfLabelIVV1
+	if v == protocol.Version2 {
+		keyLabel = hkdfLabelKeyV2
+		ivLabel = hkdfLabelIVV2
+	}
+	key := hkdfExpandLabel(suite.Hash, trafficSecret, []byte{}, keyLabel, suite.KeyLen)
+	iv := hkdfExpandLabel(suite.Hash, trafficSecret, []byte{}, ivLabel, suite.IVLen())
+	return suite.AEAD(key, iv)
+}
+
+type longHeaderSealer struct {
+	aead            *xorNonceAEAD
+	headerProtector headerProtector
+	nonceBuf        [8]byte
+}
+
+var _ LongHeaderSealer = &longHeaderSealer{}
+
+func newLongHeaderSealer(aead *xorNonceAEAD, headerProtector headerProtector) LongHeaderSealer {
+	if aead.NonceSize() != 8 {
+		panic("unexpected nonce size")
+	}
+	return &longHeaderSealer{
+		aead:            aead,
+		headerProtector: headerProtector,
+	}
+}
+
+func (s *longHeaderSealer) Seal(dst, src []byte, pn protocol.PacketNumber, ad []byte) []byte {
+	binary.BigEndian.PutUint64(s.nonceBuf[:], uint64(pn))
+	return s.aead.Seal(dst, s.nonceBuf[:], src, ad)
+}
+
+func (s *longHeaderSealer) EncryptHeader(sample []byte, firstByte *byte, pnBytes []byte) {
+	s.headerProtector.EncryptHeader(sample, firstByte, pnBytes)
+}
+
+func (s *longHeaderSealer) Overhead() int {
+	return s.aead.Overhead()
+}
+
+type longHeaderOpener struct {
+	aead            *xorNonceAEAD
+	headerProtector headerProtector
+	highestRcvdPN   protocol.PacketNumber // highest packet number received (which could be successfully unprotected)
+
+	// use a single array to avoid allocations
+	nonceBuf [8]byte
+}
+
+var _ LongHeaderOpener = &longHeaderOpener{}
+
+func newLongHeaderOpener(aead *xorNonceAEAD, headerProtector headerProtector) LongHeaderOpener {
+	if aead.NonceSize() != 8 {
+		panic("unexpected nonce size")
+	}
+	return &longHeaderOpener{
+		aead:            aead,
+		headerProtector: headerProtector,
+	}
+}
+
+func (o *longHeaderOpener) DecodePacketNumber(wirePN protocol.PacketNumber, wirePNLen protocol.PacketNumberLen) protocol.PacketNumber {
+	return protocol.DecodePacketNumber(wirePNLen, o.highestRcvdPN, wirePN)
+}
+
+func (o *longHeaderOpener) Open(dst, src []byte, pn protocol.PacketNumber, ad []byte) ([]byte, error) {
+	binary.BigEndian.PutUint64(o.nonceBuf[:], uint64(pn))
+	dec, err := o.aead.Open(dst, o.nonceBuf[:], src, ad)
+	if err == nil {
+		o.highestRcvdPN = max(o.highestRcvdPN, pn)
+	} else {
+		err = ErrDecryptionFailed
+	}
+	return dec, err
+}
+
+func (o *longHeaderOpener) DecryptHeader(sample []byte, firstByte *byte, pnBytes []byte) {
+	o.headerProtector.DecryptHeader(sample, firstByte, pnBytes)
+}

vendor/github.com/quic-go/quic-go/internal/handshake/cipher_suite.go

@@ -0,0 +1,104 @@
+package handshake
+
+import (
+	"crypto"
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/tls"
+	"fmt"
+
+	"golang.org/x/crypto/chacha20poly1305"
+)
+
+// These cipher suite implementations are copied from the standard library crypto/tls package.
+
+const aeadNonceLength = 12
+
+type cipherSuite struct {
+	ID     uint16
+	Hash   crypto.Hash
+	KeyLen int
+	AEAD   func(key, nonceMask []byte) *xorNonceAEAD
+}
+
+func (s cipherSuite) IVLen() int { return aeadNonceLength }
+
+func getCipherSuite(id uint16) cipherSuite {
+	switch id {
+	case tls.TLS_AES_128_GCM_SHA256:
+		return cipherSuite{ID: tls.TLS_AES_128_GCM_SHA256, Hash: crypto.SHA256, KeyLen: 16, AEAD: aeadAESGCMTLS13}
+	case tls.TLS_CHACHA20_POLY1305_SHA256:
+		return cipherSuite{ID: tls.TLS_CHACHA20_POLY1305_SHA256, Hash: crypto.SHA256, KeyLen: 32, AEAD: aeadChaCha20Poly1305}
+	case tls.TLS_AES_256_GCM_SHA384:
+		return cipherSuite{ID: tls.TLS_AES_256_GCM_SHA384, Hash: crypto.SHA384, KeyLen: 32, AEAD: aeadAESGCMTLS13}
+	default:
+		panic(fmt.Sprintf("unknown cypher suite: %d", id))
+	}
+}
+
+func aeadAESGCMTLS13(key, nonceMask []byte) *xorNonceAEAD {
+	if len(nonceMask) != aeadNonceLength {
+		panic("tls: internal error: wrong nonce length")
+	}
+	aes, err := aes.NewCipher(key)
+	if err != nil {
+		panic(err)
+	}
+	aead, err := cipher.NewGCM(aes)
+	if err != nil {
+		panic(err)
+	}
+
+	ret := &xorNonceAEAD{aead: aead}
+	copy(ret.nonceMask[:], nonceMask)
+	return ret
+}
+
+func aeadChaCha20Poly1305(key, nonceMask []byte) *xorNonceAEAD {
+	if len(nonceMask) != aeadNonceLength {
+		panic("tls: internal error: wrong nonce length")
+	}
+	aead, err := chacha20poly1305.New(key)
+	if err != nil {
+		panic(err)
+	}
+
+	ret := &xorNonceAEAD{aead: aead}
+	copy(ret.nonceMask[:], nonceMask)
+	return ret
+}
+
+// xorNonceAEAD wraps an AEAD by XORing in a fixed pattern to the nonce
+// before each call.
+type xorNonceAEAD struct {
+	nonceMask [aeadNonceLength]byte
+	aead      cipher.AEAD
+}
+
+func (f *xorNonceAEAD) NonceSize() int        { return 8 } // 64-bit sequence number
+func (f *xorNonceAEAD) Overhead() int         { return f.aead.Overhead() }
+func (f *xorNonceAEAD) explicitNonceLen() int { return 0 }
+
+func (f *xorNonceAEAD) Seal(out, nonce, plaintext, additionalData []byte) []byte {
+	for i, b := range nonce {
+		f.nonceMask[4+i] ^= b
+	}
+	result := f.aead.Seal(out, f.nonceMask[:], plaintext, additionalData)
+	for i, b := range nonce {
+		f.nonceMask[4+i] ^= b
+	}
+
+	return result
+}
+
+func (f *xorNonceAEAD) Open(out, nonce, ciphertext, additionalData []byte) ([]byte, error) {
+	for i, b := range nonce {
+		f.nonceMask[4+i] ^= b
+	}
+	result, err := f.aead.Open(out, f.nonceMask[:], ciphertext, additionalData)
+	for i, b := range nonce {
+		f.nonceMask[4+i] ^= b
+	}
+
+	return result, err
+}

vendor/github.com/quic-go/quic-go/internal/handshake/crypto_setup.go

@@ -0,0 +1,720 @@
+package handshake
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"net"
+	"strings"
+	"sync/atomic"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/internal/wire"
+	"github.com/quic-go/quic-go/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+type quicVersionContextKey struct{}
+
+var QUICVersionContextKey = &quicVersionContextKey{}
+
+const clientSessionStateRevision = 5
+
+type cryptoSetup struct {
+	tlsConf *tls.Config
+	conn    *tls.QUICConn
+
+	events []Event
+
+	version protocol.Version
+
+	ourParams  *wire.TransportParameters
+	peerParams *wire.TransportParameters
+
+	zeroRTTParameters *wire.TransportParameters
+	allow0RTT         bool
+
+	rttStats *utils.RTTStats
+
+	qlogger qlogwriter.Recorder
+	logger  utils.Logger
+
+	perspective protocol.Perspective
+
+	handshakeCompleteTime time.Time
+
+	zeroRTTOpener LongHeaderOpener // only set for the server
+	zeroRTTSealer LongHeaderSealer // only set for the client
+
+	initialOpener LongHeaderOpener
+	initialSealer LongHeaderSealer
+
+	handshakeOpener LongHeaderOpener
+	handshakeSealer LongHeaderSealer
+
+	used0RTT atomic.Bool
+
+	aead          *updatableAEAD
+	has1RTTSealer bool
+	has1RTTOpener bool
+}
+
+var _ CryptoSetup = &cryptoSetup{}
+
+// NewCryptoSetupClient creates a new crypto setup for the client
+func NewCryptoSetupClient(
+	connID protocol.ConnectionID,
+	tp *wire.TransportParameters,
+	tlsConf *tls.Config,
+	enable0RTT bool,
+	rttStats *utils.RTTStats,
+	qlogger qlogwriter.Recorder,
+	logger utils.Logger,
+	version protocol.Version,
+) CryptoSetup {
+	cs := newCryptoSetup(
+		connID,
+		tp,
+		rttStats,
+		qlogger,
+		logger,
+		protocol.PerspectiveClient,
+		version,
+	)
+
+	tlsConf = tlsConf.Clone()
+	tlsConf.MinVersion = tls.VersionTLS13
+	cs.tlsConf = tlsConf
+	cs.allow0RTT = enable0RTT
+
+	cs.conn = tls.QUICClient(&tls.QUICConfig{
+		TLSConfig:           tlsConf,
+		EnableSessionEvents: true,
+	})
+	cs.conn.SetTransportParameters(cs.ourParams.Marshal(protocol.PerspectiveClient))
+
+	return cs
+}
+
+// NewCryptoSetupServer creates a new crypto setup for the server
+func NewCryptoSetupServer(
+	connID protocol.ConnectionID,
+	localAddr, remoteAddr net.Addr,
+	tp *wire.TransportParameters,
+	tlsConf *tls.Config,
+	allow0RTT bool,
+	rttStats *utils.RTTStats,
+	qlogger qlogwriter.Recorder,
+	logger utils.Logger,
+	version protocol.Version,
+) CryptoSetup {
+	cs := newCryptoSetup(
+		connID,
+		tp,
+		rttStats,
+		qlogger,
+		logger,
+		protocol.PerspectiveServer,
+		version,
+	)
+	cs.allow0RTT = allow0RTT
+
+	tlsConf = setupConfigForServer(tlsConf, localAddr, remoteAddr)
+
+	cs.tlsConf = tlsConf
+	cs.conn = tls.QUICServer(&tls.QUICConfig{
+		TLSConfig:           tlsConf,
+		EnableSessionEvents: true,
+	})
+	return cs
+}
+
+func newCryptoSetup(
+	connID protocol.ConnectionID,
+	tp *wire.TransportParameters,
+	rttStats *utils.RTTStats,
+	qlogger qlogwriter.Recorder,
+	logger utils.Logger,
+	perspective protocol.Perspective,
+	version protocol.Version,
+) *cryptoSetup {
+	initialSealer, initialOpener := NewInitialAEAD(connID, perspective, version)
+	if qlogger != nil {
+		qlogger.RecordEvent(qlog.KeyUpdated{
+			Trigger: qlog.KeyUpdateTLS,
+			KeyType: encLevelToKeyType(protocol.EncryptionInitial, protocol.PerspectiveClient),
+		})
+		qlogger.RecordEvent(qlog.KeyUpdated{
+			Trigger: qlog.KeyUpdateTLS,
+			KeyType: encLevelToKeyType(protocol.EncryptionInitial, protocol.PerspectiveServer),
+		})
+	}
+	return &cryptoSetup{
+		initialSealer: initialSealer,
+		initialOpener: initialOpener,
+		aead:          newUpdatableAEAD(rttStats, qlogger, logger, version),
+		events:        make([]Event, 0, 16),
+		ourParams:     tp,
+		rttStats:      rttStats,
+		qlogger:       qlogger,
+		logger:        logger,
+		perspective:   perspective,
+		version:       version,
+	}
+}
+
+func (h *cryptoSetup) ChangeConnectionID(id protocol.ConnectionID) {
+	initialSealer, initialOpener := NewInitialAEAD(id, h.perspective, h.version)
+	h.initialSealer = initialSealer
+	h.initialOpener = initialOpener
+	if h.qlogger != nil {
+		h.qlogger.RecordEvent(qlog.KeyUpdated{
+			Trigger: qlog.KeyUpdateTLS,
+			KeyType: encLevelToKeyType(protocol.EncryptionInitial, protocol.PerspectiveClient),
+		})
+		h.qlogger.RecordEvent(qlog.KeyUpdated{
+			Trigger: qlog.KeyUpdateTLS,
+			KeyType: encLevelToKeyType(protocol.EncryptionInitial, protocol.PerspectiveServer),
+		})
+	}
+}
+
+func (h *cryptoSetup) SetLargest1RTTAcked(pn protocol.PacketNumber) error {
+	return h.aead.SetLargestAcked(pn)
+}
+
+func (h *cryptoSetup) StartHandshake(ctx context.Context) error {
+	err := h.conn.Start(context.WithValue(ctx, QUICVersionContextKey, h.version))
+	if err != nil {
+		return wrapError(err)
+	}
+	for {
+		ev := h.conn.NextEvent()
+		if err := h.handleEvent(ev); err != nil {
+			return wrapError(err)
+		}
+		if ev.Kind == tls.QUICNoEvent {
+			break
+		}
+	}
+	if h.perspective == protocol.PerspectiveClient {
+		if h.zeroRTTSealer != nil && h.zeroRTTParameters != nil {
+			h.logger.Debugf("Doing 0-RTT.")
+			h.events = append(h.events, Event{Kind: EventRestoredTransportParameters, TransportParameters: h.zeroRTTParameters})
+		} else {
+			h.logger.Debugf("Not doing 0-RTT. Has sealer: %t, has params: %t", h.zeroRTTSealer != nil, h.zeroRTTParameters != nil)
+		}
+	}
+	return nil
+}
+
+// Close closes the crypto setup.
+// It aborts the handshake, if it is still running.
+func (h *cryptoSetup) Close() error {
+	return h.conn.Close()
+}
+
+// HandleMessage handles a TLS handshake message.
+// It is called by the crypto streams when a new message is available.
+func (h *cryptoSetup) HandleMessage(data []byte, encLevel protocol.EncryptionLevel) error {
+	if err := h.handleMessage(data, encLevel); err != nil {
+		return wrapError(err)
+	}
+	return nil
+}
+
+func (h *cryptoSetup) handleMessage(data []byte, encLevel protocol.EncryptionLevel) error {
+	if err := h.conn.HandleData(encLevel.ToTLSEncryptionLevel(), data); err != nil {
+		return err
+	}
+	for {
+		ev := h.conn.NextEvent()
+		if err := h.handleEvent(ev); err != nil {
+			return err
+		}
+		if ev.Kind == tls.QUICNoEvent {
+			return nil
+		}
+	}
+}
+
+func (h *cryptoSetup) handleEvent(ev tls.QUICEvent) (err error) {
+	switch ev.Kind {
+	case tls.QUICNoEvent:
+		return nil
+	case tls.QUICSetReadSecret:
+		h.setReadKey(ev.Level, ev.Suite, ev.Data)
+		return nil
+	case tls.QUICSetWriteSecret:
+		h.setWriteKey(ev.Level, ev.Suite, ev.Data)
+		return nil
+	case tls.QUICTransportParameters:
+		return h.handleTransportParameters(ev.Data)
+	case tls.QUICTransportParametersRequired:
+		h.conn.SetTransportParameters(h.ourParams.Marshal(h.perspective))
+		return nil
+	case tls.QUICRejectedEarlyData:
+		h.rejected0RTT()
+		return nil
+	case tls.QUICWriteData:
+		h.writeRecord(ev.Level, ev.Data)
+		return nil
+	case tls.QUICHandshakeDone:
+		h.handshakeComplete()
+		return nil
+	case tls.QUICStoreSession:
+		if h.perspective == protocol.PerspectiveServer {
+			panic("cryptoSetup BUG: unexpected QUICStoreSession event for the server")
+		}
+		ev.SessionState.Extra = append(
+			ev.SessionState.Extra,
+			addSessionStateExtraPrefix(h.marshalDataForSessionState(ev.SessionState.EarlyData)),
+		)
+		return h.conn.StoreSession(ev.SessionState)
+	case tls.QUICResumeSession:
+		var allowEarlyData bool
+		switch h.perspective {
+		case protocol.PerspectiveClient:
+			// for clients, this event occurs when a session ticket is selected
+			allowEarlyData = h.handleDataFromSessionState(
+				findSessionStateExtraData(ev.SessionState.Extra),
+				ev.SessionState.EarlyData,
+			)
+		case protocol.PerspectiveServer:
+			// for servers, this event occurs when receiving the client's session ticket
+			allowEarlyData = h.handleSessionTicket(
+				findSessionStateExtraData(ev.SessionState.Extra),
+				ev.SessionState.EarlyData,
+			)
+		}
+		if ev.SessionState.EarlyData {
+			ev.SessionState.EarlyData = allowEarlyData
+		}
+		return nil
+	default:
+		// Unknown events should be ignored.
+		// crypto/tls will ensure that this is safe to do.
+		// See the discussion following https://github.com/golang/go/issues/68124#issuecomment-2187042510 for details.
+		return nil
+	}
+}
+
+func (h *cryptoSetup) NextEvent() Event {
+	if len(h.events) == 0 {
+		return Event{Kind: EventNoEvent}
+	}
+	ev := h.events[0]
+	h.events = h.events[1:]
+	return ev
+}
+
+func (h *cryptoSetup) handleTransportParameters(data []byte) error {
+	var tp wire.TransportParameters
+	if err := tp.Unmarshal(data, h.perspective.Opposite()); err != nil {
+		return err
+	}
+	h.peerParams = &tp
+	h.events = append(h.events, Event{Kind: EventReceivedTransportParameters, TransportParameters: h.peerParams})
+	return nil
+}
+
+// must be called after receiving the transport parameters
+func (h *cryptoSetup) marshalDataForSessionState(earlyData bool) []byte {
+	b := make([]byte, 0, 256)
+	b = quicvarint.Append(b, clientSessionStateRevision)
+	if earlyData {
+		// only save the transport parameters for 0-RTT enabled session tickets
+		return h.peerParams.MarshalForSessionTicket(b)
+	}
+	return b
+}
+
+func (h *cryptoSetup) handleDataFromSessionState(data []byte, earlyData bool) (allowEarlyData bool) {
+	tp, err := decodeDataFromSessionState(data, earlyData)
+	if err != nil {
+		h.logger.Debugf("Restoring of transport parameters from session ticket failed: %s", err.Error())
+		return
+	}
+	// The session ticket might have been saved from a connection that allowed 0-RTT,
+	// and therefore contain transport parameters.
+	// Only use them if 0-RTT is actually used on the new connection.
+	if tp != nil && h.allow0RTT {
+		h.zeroRTTParameters = tp
+		return true
+	}
+	return false
+}
+
+func decodeDataFromSessionState(b []byte, earlyData bool) (*wire.TransportParameters, error) {
+	ver, l, err := quicvarint.Parse(b)
+	if err != nil {
+		return nil, err
+	}
+	b = b[l:]
+	if ver != clientSessionStateRevision {
+		return nil, fmt.Errorf("mismatching version. Got %d, expected %d", ver, clientSessionStateRevision)
+	}
+	if !earlyData {
+		return nil, nil
+	}
+	var tp wire.TransportParameters
+	if err := tp.UnmarshalFromSessionTicket(b); err != nil {
+		return nil, err
+	}
+	return &tp, nil
+}
+
+func (h *cryptoSetup) getDataForSessionTicket() []byte {
+	return (&sessionTicket{
+		Parameters: h.ourParams,
+	}).Marshal()
+}
+
+// GetSessionTicket generates a new session ticket.
+// Due to limitations in crypto/tls, it's only possible to generate a single session ticket per connection.
+// It is only valid for the server.
+func (h *cryptoSetup) GetSessionTicket() ([]byte, error) {
+	if err := h.conn.SendSessionTicket(tls.QUICSessionTicketOptions{
+		EarlyData: h.allow0RTT,
+		Extra:     [][]byte{addSessionStateExtraPrefix(h.getDataForSessionTicket())},
+	}); err != nil {
+		// Session tickets might be disabled by tls.Config.SessionTicketsDisabled.
+		// We can't check h.tlsConfig here, since the actual config might have been obtained from
+		// the GetConfigForClient callback.
+		// See https://github.com/golang/go/issues/62032.
+		// This error assertion can be removed once we drop support for Go 1.25.
+		if strings.Contains(err.Error(), "session ticket keys unavailable") {
+			return nil, nil
+		}
+		return nil, err
+	}
+	// If session tickets are disabled, NextEvent will immediately return QUICNoEvent,
+	// and we will return a nil ticket.
+	var ticket []byte
+	for {
+		ev := h.conn.NextEvent()
+		if ev.Kind == tls.QUICNoEvent {
+			break
+		}
+		if ev.Kind == tls.QUICWriteData && ev.Level == tls.QUICEncryptionLevelApplication {
+			if ticket != nil {
+				h.logger.Errorf("unexpected multiple session tickets")
+				continue
+			}
+			ticket = ev.Data
+		} else {
+			h.logger.Errorf("unexpected event: %v", ev.Kind)
+		}
+	}
+	return ticket, nil
+}
+
+// handleSessionTicket is called for the server when receiving the client's session ticket.
+// It reads parameters from the session ticket and checks whether to accept 0-RTT if the session ticket enabled 0-RTT.
+// Note that the fact that the session ticket allows 0-RTT doesn't mean that the actual TLS handshake enables 0-RTT:
+// A client may use a 0-RTT enabled session to resume a TLS session without using 0-RTT.
+func (h *cryptoSetup) handleSessionTicket(data []byte, using0RTT bool) (allowEarlyData bool) {
+	var t sessionTicket
+	if err := t.Unmarshal(data); err != nil {
+		h.logger.Debugf("Unmarshalling session ticket failed: %s", err.Error())
+		return false
+	}
+	if !using0RTT {
+		return false
+	}
+	valid := h.ourParams.ValidFor0RTT(t.Parameters)
+	if !valid {
+		h.logger.Debugf("Transport parameters changed. Rejecting 0-RTT.")
+		return false
+	}
+	if !h.allow0RTT {
+		h.logger.Debugf("0-RTT not allowed. Rejecting 0-RTT.")
+		return false
+	}
+	return true
+}
+
+// rejected0RTT is called for the client when the server rejects 0-RTT.
+func (h *cryptoSetup) rejected0RTT() {
+	h.logger.Debugf("0-RTT was rejected. Dropping 0-RTT keys.")
+
+	had0RTTKeys := h.zeroRTTSealer != nil
+	h.zeroRTTSealer = nil
+
+	if had0RTTKeys {
+		h.events = append(h.events, Event{Kind: EventDiscard0RTTKeys})
+	}
+}
+
+func (h *cryptoSetup) setReadKey(el tls.QUICEncryptionLevel, suiteID uint16, trafficSecret []byte) {
+	suite := getCipherSuite(suiteID)
+	//nolint:exhaustive // The TLS stack doesn't export Initial keys.
+	switch el {
+	case tls.QUICEncryptionLevelEarly:
+		if h.perspective == protocol.PerspectiveClient {
+			panic("Received 0-RTT read key for the client")
+		}
+		h.zeroRTTOpener = newLongHeaderOpener(
+			createAEAD(suite, trafficSecret, h.version),
+			newHeaderProtector(suite, trafficSecret, true, h.version),
+		)
+		h.used0RTT.Store(true)
+		if h.logger.Debug() {
+			h.logger.Debugf("Installed 0-RTT Read keys (using %s)", tls.CipherSuiteName(suite.ID))
+		}
+	case tls.QUICEncryptionLevelHandshake:
+		h.handshakeOpener = newLongHeaderOpener(
+			createAEAD(suite, trafficSecret, h.version),
+			newHeaderProtector(suite, trafficSecret, true, h.version),
+		)
+		if h.logger.Debug() {
+			h.logger.Debugf("Installed Handshake Read keys (using %s)", tls.CipherSuiteName(suite.ID))
+		}
+	case tls.QUICEncryptionLevelApplication:
+		h.aead.SetReadKey(suite, trafficSecret)
+		h.has1RTTOpener = true
+		if h.logger.Debug() {
+			h.logger.Debugf("Installed 1-RTT Read keys (using %s)", tls.CipherSuiteName(suite.ID))
+		}
+	default:
+		panic("unexpected read encryption level")
+	}
+	h.events = append(h.events, Event{Kind: EventReceivedReadKeys})
+	if h.qlogger != nil {
+		h.qlogger.RecordEvent(qlog.KeyUpdated{
+			Trigger: qlog.KeyUpdateTLS,
+			KeyType: encLevelToKeyType(protocol.FromTLSEncryptionLevel(el), h.perspective.Opposite()),
+		})
+	}
+}
+
+func (h *cryptoSetup) setWriteKey(el tls.QUICEncryptionLevel, suiteID uint16, trafficSecret []byte) {
+	suite := getCipherSuite(suiteID)
+	//nolint:exhaustive // The TLS stack doesn't export Initial keys.
+	switch el {
+	case tls.QUICEncryptionLevelEarly:
+		if h.perspective == protocol.PerspectiveServer {
+			panic("Received 0-RTT write key for the server")
+		}
+		h.zeroRTTSealer = newLongHeaderSealer(
+			createAEAD(suite, trafficSecret, h.version),
+			newHeaderProtector(suite, trafficSecret, true, h.version),
+		)
+		if h.logger.Debug() {
+			h.logger.Debugf("Installed 0-RTT Write keys (using %s)", tls.CipherSuiteName(suite.ID))
+		}
+		if h.qlogger != nil {
+			h.qlogger.RecordEvent(qlog.KeyUpdated{
+				Trigger: qlog.KeyUpdateTLS,
+				KeyType: encLevelToKeyType(protocol.Encryption0RTT, h.perspective),
+			})
+		}
+		// don't set used0RTT here. 0-RTT might still get rejected.
+		return
+	case tls.QUICEncryptionLevelHandshake:
+		h.handshakeSealer = newLongHeaderSealer(
+			createAEAD(suite, trafficSecret, h.version),
+			newHeaderProtector(suite, trafficSecret, true, h.version),
+		)
+		if h.logger.Debug() {
+			h.logger.Debugf("Installed Handshake Write keys (using %s)", tls.CipherSuiteName(suite.ID))
+		}
+	case tls.QUICEncryptionLevelApplication:
+		h.aead.SetWriteKey(suite, trafficSecret)
+		h.has1RTTSealer = true
+		if h.logger.Debug() {
+			h.logger.Debugf("Installed 1-RTT Write keys (using %s)", tls.CipherSuiteName(suite.ID))
+		}
+		if h.zeroRTTSealer != nil {
+			// Once we receive handshake keys, we know that 0-RTT was not rejected.
+			h.used0RTT.Store(true)
+			h.zeroRTTSealer = nil
+			h.logger.Debugf("Dropping 0-RTT keys.")
+			if h.qlogger != nil {
+				h.qlogger.RecordEvent(qlog.KeyDiscarded{KeyType: qlog.KeyTypeClient0RTT})
+			}
+		}
+	default:
+		panic("unexpected write encryption level")
+	}
+	if h.qlogger != nil {
+		h.qlogger.RecordEvent(qlog.KeyUpdated{
+			Trigger: qlog.KeyUpdateTLS,
+			KeyType: encLevelToKeyType(protocol.FromTLSEncryptionLevel(el), h.perspective),
+		})
+	}
+}
+
+// writeRecord is called when TLS writes data
+func (h *cryptoSetup) writeRecord(encLevel tls.QUICEncryptionLevel, p []byte) {
+	//nolint:exhaustive // handshake records can only be written for Initial and Handshake.
+	switch encLevel {
+	case tls.QUICEncryptionLevelInitial:
+		h.events = append(h.events, Event{Kind: EventWriteInitialData, Data: p})
+	case tls.QUICEncryptionLevelHandshake:
+		h.events = append(h.events, Event{Kind: EventWriteHandshakeData, Data: p})
+	case tls.QUICEncryptionLevelApplication:
+		panic("unexpected write")
+	default:
+		panic(fmt.Sprintf("unexpected write encryption level: %s", encLevel))
+	}
+}
+
+func (h *cryptoSetup) DiscardInitialKeys() {
+	dropped := h.initialOpener != nil
+	h.initialOpener = nil
+	h.initialSealer = nil
+	if dropped {
+		h.logger.Debugf("Dropping Initial keys.")
+		if h.qlogger != nil {
+			h.qlogger.RecordEvent(qlog.KeyDiscarded{KeyType: qlog.KeyTypeClientInitial})
+			h.qlogger.RecordEvent(qlog.KeyDiscarded{KeyType: qlog.KeyTypeServerInitial})
+		}
+	}
+}
+
+func (h *cryptoSetup) handshakeComplete() {
+	h.handshakeCompleteTime = time.Now()
+	h.events = append(h.events, Event{Kind: EventHandshakeComplete})
+}
+
+func (h *cryptoSetup) SetHandshakeConfirmed() {
+	h.aead.SetHandshakeConfirmed()
+	// drop Handshake keys
+	var dropped bool
+	if h.handshakeOpener != nil {
+		h.handshakeOpener = nil
+		h.handshakeSealer = nil
+		dropped = true
+	}
+	if dropped {
+		h.logger.Debugf("Dropping Handshake keys.")
+		if h.qlogger != nil {
+			h.qlogger.RecordEvent(qlog.KeyDiscarded{KeyType: qlog.KeyTypeClientHandshake})
+			h.qlogger.RecordEvent(qlog.KeyDiscarded{KeyType: qlog.KeyTypeServerHandshake})
+		}
+	}
+}
+
+func (h *cryptoSetup) GetInitialSealer() (LongHeaderSealer, error) {
+	if h.initialSealer == nil {
+		return nil, ErrKeysDropped
+	}
+	return h.initialSealer, nil
+}
+
+func (h *cryptoSetup) Get0RTTSealer() (LongHeaderSealer, error) {
+	if h.zeroRTTSealer == nil {
+		return nil, ErrKeysDropped
+	}
+	return h.zeroRTTSealer, nil
+}
+
+func (h *cryptoSetup) GetHandshakeSealer() (LongHeaderSealer, error) {
+	if h.handshakeSealer == nil {
+		if h.initialSealer == nil {
+			return nil, ErrKeysDropped
+		}
+		return nil, ErrKeysNotYetAvailable
+	}
+	return h.handshakeSealer, nil
+}
+
+func (h *cryptoSetup) Get1RTTSealer() (ShortHeaderSealer, error) {
+	if !h.has1RTTSealer {
+		return nil, ErrKeysNotYetAvailable
+	}
+	return h.aead, nil
+}
+
+func (h *cryptoSetup) GetInitialOpener() (LongHeaderOpener, error) {
+	if h.initialOpener == nil {
+		return nil, ErrKeysDropped
+	}
+	return h.initialOpener, nil
+}
+
+func (h *cryptoSetup) Get0RTTOpener() (LongHeaderOpener, error) {
+	if h.zeroRTTOpener == nil {
+		if h.initialOpener != nil {
+			return nil, ErrKeysNotYetAvailable
+		}
+		// if the initial opener is also not available, the keys were already dropped
+		return nil, ErrKeysDropped
+	}
+	return h.zeroRTTOpener, nil
+}
+
+func (h *cryptoSetup) GetHandshakeOpener() (LongHeaderOpener, error) {
+	if h.handshakeOpener == nil {
+		if h.initialOpener != nil {
+			return nil, ErrKeysNotYetAvailable
+		}
+		// if the initial opener is also not available, the keys were already dropped
+		return nil, ErrKeysDropped
+	}
+	return h.handshakeOpener, nil
+}
+
+func (h *cryptoSetup) Get1RTTOpener() (ShortHeaderOpener, error) {
+	if h.zeroRTTOpener != nil && time.Since(h.handshakeCompleteTime) > 3*h.rttStats.PTO(true) {
+		h.zeroRTTOpener = nil
+		h.logger.Debugf("Dropping 0-RTT keys.")
+		if h.qlogger != nil {
+			h.qlogger.RecordEvent(qlog.KeyDiscarded{KeyType: qlog.KeyTypeClient0RTT})
+		}
+	}
+
+	if !h.has1RTTOpener {
+		return nil, ErrKeysNotYetAvailable
+	}
+	return h.aead, nil
+}
+
+func (h *cryptoSetup) ConnectionState() ConnectionState {
+	return ConnectionState{
+		ConnectionState: h.conn.ConnectionState(),
+		Used0RTT:        h.used0RTT.Load(),
+	}
+}
+
+func wrapError(err error) error {
+	if alertErr := tls.AlertError(0); errors.As(err, &alertErr) {
+		return qerr.NewLocalCryptoError(uint8(alertErr), err)
+	}
+	return &qerr.TransportError{ErrorCode: qerr.InternalError, ErrorMessage: err.Error()}
+}
+
+func encLevelToKeyType(encLevel protocol.EncryptionLevel, pers protocol.Perspective) qlog.KeyType {
+	if pers == protocol.PerspectiveServer {
+		switch encLevel {
+		case protocol.EncryptionInitial:
+			return qlog.KeyTypeServerInitial
+		case protocol.EncryptionHandshake:
+			return qlog.KeyTypeServerHandshake
+		case protocol.Encryption0RTT:
+			return qlog.KeyTypeServer0RTT
+		case protocol.Encryption1RTT:
+			return qlog.KeyTypeServer1RTT
+		default:
+			return ""
+		}
+	}
+	switch encLevel {
+	case protocol.EncryptionInitial:
+		return qlog.KeyTypeClientInitial
+	case protocol.EncryptionHandshake:
+		return qlog.KeyTypeClientHandshake
+	case protocol.Encryption0RTT:
+		return qlog.KeyTypeClient0RTT
+	case protocol.Encryption1RTT:
+		return qlog.KeyTypeClient1RTT
+	default:
+		return ""
+	}
+}

vendor/github.com/quic-go/quic-go/internal/handshake/fake_conn.go

@@ -0,0 +1,21 @@
+package handshake
+
+import (
+	"net"
+	"time"
+)
+
+type conn struct {
+	localAddr, remoteAddr net.Addr
+}
+
+var _ net.Conn = &conn{}
+
+func (c *conn) Read([]byte) (int, error)         { return 0, nil }
+func (c *conn) Write([]byte) (int, error)        { return 0, nil }
+func (c *conn) Close() error                     { return nil }
+func (c *conn) RemoteAddr() net.Addr             { return c.remoteAddr }
+func (c *conn) LocalAddr() net.Addr              { return c.localAddr }
+func (c *conn) SetReadDeadline(time.Time) error  { return nil }
+func (c *conn) SetWriteDeadline(time.Time) error { return nil }
+func (c *conn) SetDeadline(time.Time) error      { return nil }

vendor/github.com/quic-go/quic-go/internal/handshake/header_protector.go

@@ -0,0 +1,134 @@
+package handshake
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/tls"
+	"encoding/binary"
+	"fmt"
+
+	"golang.org/x/crypto/chacha20"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+)
+
+type headerProtector interface {
+	EncryptHeader(sample []byte, firstByte *byte, hdrBytes []byte)
+	DecryptHeader(sample []byte, firstByte *byte, hdrBytes []byte)
+}
+
+func hkdfHeaderProtectionLabel(v protocol.Version) string {
+	if v == protocol.Version2 {
+		return "quicv2 hp"
+	}
+	return "quic hp"
+}
+
+func newHeaderProtector(suite cipherSuite, trafficSecret []byte, isLongHeader bool, v protocol.Version) headerProtector {
+	hkdfLabel := hkdfHeaderProtectionLabel(v)
+	switch suite.ID {
+	case tls.TLS_AES_128_GCM_SHA256, tls.TLS_AES_256_GCM_SHA384:
+		return newAESHeaderProtector(suite, trafficSecret, isLongHeader, hkdfLabel)
+	case tls.TLS_CHACHA20_POLY1305_SHA256:
+		return newChaChaHeaderProtector(suite, trafficSecret, isLongHeader, hkdfLabel)
+	default:
+		panic(fmt.Sprintf("Invalid cipher suite id: %d", suite.ID))
+	}
+}
+
+type aesHeaderProtector struct {
+	mask         [16]byte // AES always has a 16 byte block size
+	block        cipher.Block
+	isLongHeader bool
+}
+
+var _ headerProtector = &aesHeaderProtector{}
+
+func newAESHeaderProtector(suite cipherSuite, trafficSecret []byte, isLongHeader bool, hkdfLabel string) headerProtector {
+	hpKey := hkdfExpandLabel(suite.Hash, trafficSecret, []byte{}, hkdfLabel, suite.KeyLen)
+	block, err := aes.NewCipher(hpKey)
+	if err != nil {
+		panic(fmt.Sprintf("error creating new AES cipher: %s", err))
+	}
+	return &aesHeaderProtector{
+		block:        block,
+		isLongHeader: isLongHeader,
+	}
+}
+
+func (p *aesHeaderProtector) DecryptHeader(sample []byte, firstByte *byte, hdrBytes []byte) {
+	p.apply(sample, firstByte, hdrBytes)
+}
+
+func (p *aesHeaderProtector) EncryptHeader(sample []byte, firstByte *byte, hdrBytes []byte) {
+	p.apply(sample, firstByte, hdrBytes)
+}
+
+func (p *aesHeaderProtector) apply(sample []byte, firstByte *byte, hdrBytes []byte) {
+	if len(sample) != len(p.mask) {
+		panic("invalid sample size")
+	}
+	p.block.Encrypt(p.mask[:], sample)
+	if p.isLongHeader {
+		*firstByte ^= p.mask[0] & 0xf
+	} else {
+		*firstByte ^= p.mask[0] & 0x1f
+	}
+	for i := range hdrBytes {
+		hdrBytes[i] ^= p.mask[i+1]
+	}
+}
+
+type chachaHeaderProtector struct {
+	mask [5]byte
+
+	key          [32]byte
+	isLongHeader bool
+}
+
+var _ headerProtector = &chachaHeaderProtector{}
+
+func newChaChaHeaderProtector(suite cipherSuite, trafficSecret []byte, isLongHeader bool, hkdfLabel string) headerProtector {
+	hpKey := hkdfExpandLabel(suite.Hash, trafficSecret, []byte{}, hkdfLabel, suite.KeyLen)
+
+	p := &chachaHeaderProtector{
+		isLongHeader: isLongHeader,
+	}
+	copy(p.key[:], hpKey)
+	return p
+}
+
+func (p *chachaHeaderProtector) DecryptHeader(sample []byte, firstByte *byte, hdrBytes []byte) {
+	p.apply(sample, firstByte, hdrBytes)
+}
+
+func (p *chachaHeaderProtector) EncryptHeader(sample []byte, firstByte *byte, hdrBytes []byte) {
+	p.apply(sample, firstByte, hdrBytes)
+}
+
+func (p *chachaHeaderProtector) apply(sample []byte, firstByte *byte, hdrBytes []byte) {
+	if len(sample) != 16 {
+		panic("invalid sample size")
+	}
+	for i := 0; i < 5; i++ {
+		p.mask[i] = 0
+	}
+	cipher, err := chacha20.NewUnauthenticatedCipher(p.key[:], sample[4:])
+	if err != nil {
+		panic(err)
+	}
+	cipher.SetCounter(binary.LittleEndian.Uint32(sample[:4]))
+	cipher.XORKeyStream(p.mask[:], p.mask[:])
+	p.applyMask(firstByte, hdrBytes)
+}
+
+func (p *chachaHeaderProtector) applyMask(firstByte *byte, hdrBytes []byte) {
+	if p.isLongHeader {
+		*firstByte ^= p.mask[0] & 0xf
+	} else {
+		*firstByte ^= p.mask[0] & 0x1f
+	}
+	for i := range hdrBytes {
+		hdrBytes[i] ^= p.mask[i+1]
+	}
+}

vendor/github.com/quic-go/quic-go/internal/handshake/hkdf.go

@@ -0,0 +1,27 @@
+package handshake
+
+import (
+	"crypto"
+	"encoding/binary"
+
+	"golang.org/x/crypto/hkdf"
+)
+
+// hkdfExpandLabel HKDF expands a label as defined in RFC 8446, section 7.1.
+func hkdfExpandLabel(hash crypto.Hash, secret, context []byte, label string, length int) []byte {
+	b := make([]byte, 3, 3+6+len(label)+1+len(context))
+	binary.BigEndian.PutUint16(b, uint16(length))
+	b[2] = uint8(6 + len(label))
+	b = append(b, []byte("tls13 ")...)
+	b = append(b, []byte(label)...)
+	b = b[:3+6+len(label)+1]
+	b[3+6+len(label)] = uint8(len(context))
+	b = append(b, context...)
+
+	out := make([]byte, length)
+	n, err := hkdf.Expand(hash.New, secret, b).Read(out)
+	if err != nil || n != length {
+		panic("quic: HKDF-Expand-Label invocation failed unexpectedly")
+	}
+	return out
+}

vendor/github.com/quic-go/quic-go/internal/handshake/initial_aead.go

@@ -0,0 +1,71 @@
+package handshake
+
+import (
+	"crypto"
+	"crypto/tls"
+
+	"golang.org/x/crypto/hkdf"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+)
+
+var (
+	quicSaltV1 = []byte{0x38, 0x76, 0x2c, 0xf7, 0xf5, 0x59, 0x34, 0xb3, 0x4d, 0x17, 0x9a, 0xe6, 0xa4, 0xc8, 0x0c, 0xad, 0xcc, 0xbb, 0x7f, 0x0a}
+	quicSaltV2 = []byte{0x0d, 0xed, 0xe3, 0xde, 0xf7, 0x00, 0xa6, 0xdb, 0x81, 0x93, 0x81, 0xbe, 0x6e, 0x26, 0x9d, 0xcb, 0xf9, 0xbd, 0x2e, 0xd9}
+)
+
+const (
+	hkdfLabelKeyV1 = "quic key"
+	hkdfLabelKeyV2 = "quicv2 key"
+	hkdfLabelIVV1  = "quic iv"
+	hkdfLabelIVV2  = "quicv2 iv"
+)
+
+func getSalt(v protocol.Version) []byte {
+	if v == protocol.Version2 {
+		return quicSaltV2
+	}
+	return quicSaltV1
+}
+
+var initialSuite = getCipherSuite(tls.TLS_AES_128_GCM_SHA256)
+
+// NewInitialAEAD creates a new AEAD for Initial encryption / decryption.
+func NewInitialAEAD(connID protocol.ConnectionID, pers protocol.Perspective, v protocol.Version) (LongHeaderSealer, LongHeaderOpener) {
+	clientSecret, serverSecret := computeSecrets(connID, v)
+	var mySecret, otherSecret []byte
+	if pers == protocol.PerspectiveClient {
+		mySecret = clientSecret
+		otherSecret = serverSecret
+	} else {
+		mySecret = serverSecret
+		otherSecret = clientSecret
+	}
+	myKey, myIV := computeInitialKeyAndIV(mySecret, v)
+	otherKey, otherIV := computeInitialKeyAndIV(otherSecret, v)
+
+	encrypter := initialSuite.AEAD(myKey, myIV)
+	decrypter := initialSuite.AEAD(otherKey, otherIV)
+
+	return newLongHeaderSealer(encrypter, newHeaderProtector(initialSuite, mySecret, true, v)),
+		newLongHeaderOpener(decrypter, newAESHeaderProtector(initialSuite, otherSecret, true, hkdfHeaderProtectionLabel(v)))
+}
+
+func computeSecrets(connID protocol.ConnectionID, v protocol.Version) (clientSecret, serverSecret []byte) {
+	initialSecret := hkdf.Extract(crypto.SHA256.New, connID.Bytes(), getSalt(v))
+	clientSecret = hkdfExpandLabel(crypto.SHA256, initialSecret, []byte{}, "client in", crypto.SHA256.Size())
+	serverSecret = hkdfExpandLabel(crypto.SHA256, initialSecret, []byte{}, "server in", crypto.SHA256.Size())
+	return
+}
+
+func computeInitialKeyAndIV(secret []byte, v protocol.Version) (key, iv []byte) {
+	keyLabel := hkdfLabelKeyV1
+	ivLabel := hkdfLabelIVV1
+	if v == protocol.Version2 {
+		keyLabel = hkdfLabelKeyV2
+		ivLabel = hkdfLabelIVV2
+	}
+	key = hkdfExpandLabel(crypto.SHA256, secret, []byte{}, keyLabel, 16)
+	iv = hkdfExpandLabel(crypto.SHA256, secret, []byte{}, ivLabel, 12)
+	return
+}

vendor/github.com/quic-go/quic-go/internal/handshake/interface.go

@@ -0,0 +1,140 @@
+package handshake
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"io"
+
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/wire"
+)
+
+var (
+	// ErrKeysNotYetAvailable is returned when an opener or a sealer is requested for an encryption level,
+	// but the corresponding opener has not yet been initialized
+	// This can happen when packets arrive out of order.
+	ErrKeysNotYetAvailable = errors.New("CryptoSetup: keys at this encryption level not yet available")
+	// ErrKeysDropped is returned when an opener or a sealer is requested for an encryption level,
+	// but the corresponding keys have already been dropped.
+	ErrKeysDropped = errors.New("CryptoSetup: keys were already dropped")
+	// ErrDecryptionFailed is returned when the AEAD fails to open the packet.
+	ErrDecryptionFailed = errors.New("decryption failed")
+)
+
+type headerDecryptor interface {
+	DecryptHeader(sample []byte, firstByte *byte, pnBytes []byte)
+}
+
+// LongHeaderOpener opens a long header packet
+type LongHeaderOpener interface {
+	headerDecryptor
+	DecodePacketNumber(wirePN protocol.PacketNumber, wirePNLen protocol.PacketNumberLen) protocol.PacketNumber
+	Open(dst, src []byte, pn protocol.PacketNumber, associatedData []byte) ([]byte, error)
+}
+
+// ShortHeaderOpener opens a short header packet
+type ShortHeaderOpener interface {
+	headerDecryptor
+	DecodePacketNumber(wirePN protocol.PacketNumber, wirePNLen protocol.PacketNumberLen) protocol.PacketNumber
+	Open(dst, src []byte, rcvTime monotime.Time, pn protocol.PacketNumber, kp protocol.KeyPhaseBit, associatedData []byte) ([]byte, error)
+}
+
+// LongHeaderSealer seals a long header packet
+type LongHeaderSealer interface {
+	Seal(dst, src []byte, packetNumber protocol.PacketNumber, associatedData []byte) []byte
+	EncryptHeader(sample []byte, firstByte *byte, pnBytes []byte)
+	Overhead() int
+}
+
+// ShortHeaderSealer seals a short header packet
+type ShortHeaderSealer interface {
+	LongHeaderSealer
+	KeyPhase() protocol.KeyPhaseBit
+}
+
+type ConnectionState struct {
+	tls.ConnectionState
+	Used0RTT bool
+}
+
+// EventKind is the kind of handshake event.
+type EventKind uint8
+
+const (
+	// EventNoEvent signals that there are no new handshake events
+	EventNoEvent EventKind = iota + 1
+	// EventWriteInitialData contains new CRYPTO data to send at the Initial encryption level
+	EventWriteInitialData
+	// EventWriteHandshakeData contains new CRYPTO data to send at the Handshake encryption level
+	EventWriteHandshakeData
+	// EventReceivedReadKeys signals that new decryption keys are available.
+	// It doesn't say which encryption level those keys are for.
+	EventReceivedReadKeys
+	// EventDiscard0RTTKeys signals that the Handshake keys were discarded.
+	EventDiscard0RTTKeys
+	// EventReceivedTransportParameters contains the transport parameters sent by the peer.
+	EventReceivedTransportParameters
+	// EventRestoredTransportParameters contains the transport parameters restored from the session ticket.
+	// It is only used for the client.
+	EventRestoredTransportParameters
+	// EventHandshakeComplete signals that the TLS handshake was completed.
+	EventHandshakeComplete
+)
+
+func (k EventKind) String() string {
+	switch k {
+	case EventNoEvent:
+		return "EventNoEvent"
+	case EventWriteInitialData:
+		return "EventWriteInitialData"
+	case EventWriteHandshakeData:
+		return "EventWriteHandshakeData"
+	case EventReceivedReadKeys:
+		return "EventReceivedReadKeys"
+	case EventDiscard0RTTKeys:
+		return "EventDiscard0RTTKeys"
+	case EventReceivedTransportParameters:
+		return "EventReceivedTransportParameters"
+	case EventRestoredTransportParameters:
+		return "EventRestoredTransportParameters"
+	case EventHandshakeComplete:
+		return "EventHandshakeComplete"
+	default:
+		return "Unknown EventKind"
+	}
+}
+
+// Event is a handshake event.
+type Event struct {
+	Kind                EventKind
+	Data                []byte
+	TransportParameters *wire.TransportParameters
+}
+
+// CryptoSetup handles the handshake and protecting / unprotecting packets
+type CryptoSetup interface {
+	StartHandshake(context.Context) error
+	io.Closer
+	ChangeConnectionID(protocol.ConnectionID)
+	GetSessionTicket() ([]byte, error)
+
+	HandleMessage([]byte, protocol.EncryptionLevel) error
+	NextEvent() Event
+
+	SetLargest1RTTAcked(protocol.PacketNumber) error
+	DiscardInitialKeys()
+	SetHandshakeConfirmed()
+	ConnectionState() ConnectionState
+
+	GetInitialOpener() (LongHeaderOpener, error)
+	GetHandshakeOpener() (LongHeaderOpener, error)
+	Get0RTTOpener() (LongHeaderOpener, error)
+	Get1RTTOpener() (ShortHeaderOpener, error)
+
+	GetInitialSealer() (LongHeaderSealer, error)
+	GetHandshakeSealer() (LongHeaderSealer, error)
+	Get0RTTSealer() (LongHeaderSealer, error)
+	Get1RTTSealer() (ShortHeaderSealer, error)
+}

vendor/github.com/quic-go/quic-go/internal/handshake/retry.go

@@ -0,0 +1,66 @@
+package handshake
+
+import (
+	"bytes"
+	"crypto/aes"
+	"crypto/cipher"
+	"fmt"
+	"sync"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+)
+
+// Instead of using an init function, the AEADs are created lazily.
+// For more details see https://github.com/quic-go/quic-go/issues/4894.
+var (
+	retryAEADv1 cipher.AEAD // used for QUIC v1 (RFC 9000)
+	retryAEADv2 cipher.AEAD // used for QUIC v2 (RFC 9369)
+)
+
+func initAEAD(key [16]byte) cipher.AEAD {
+	aes, err := aes.NewCipher(key[:])
+	if err != nil {
+		panic(err)
+	}
+	aead, err := cipher.NewGCM(aes)
+	if err != nil {
+		panic(err)
+	}
+	return aead
+}
+
+var (
+	retryBuf     bytes.Buffer
+	retryMutex   sync.Mutex
+	retryNonceV1 = [12]byte{0x46, 0x15, 0x99, 0xd3, 0x5d, 0x63, 0x2b, 0xf2, 0x23, 0x98, 0x25, 0xbb}
+	retryNonceV2 = [12]byte{0xd8, 0x69, 0x69, 0xbc, 0x2d, 0x7c, 0x6d, 0x99, 0x90, 0xef, 0xb0, 0x4a}
+)
+
+// GetRetryIntegrityTag calculates the integrity tag on a Retry packet
+func GetRetryIntegrityTag(retry []byte, origDestConnID protocol.ConnectionID, version protocol.Version) *[16]byte {
+	retryMutex.Lock()
+	defer retryMutex.Unlock()
+
+	retryBuf.WriteByte(uint8(origDestConnID.Len()))
+	retryBuf.Write(origDestConnID.Bytes())
+	retryBuf.Write(retry)
+	defer retryBuf.Reset()
+
+	var tag [16]byte
+	var sealed []byte
+	if version == protocol.Version2 {
+		if retryAEADv2 == nil {
+			retryAEADv2 = initAEAD([16]byte{0x8f, 0xb4, 0xb0, 0x1b, 0x56, 0xac, 0x48, 0xe2, 0x60, 0xfb, 0xcb, 0xce, 0xad, 0x7c, 0xcc, 0x92})
+		}
+		sealed = retryAEADv2.Seal(tag[:0], retryNonceV2[:], nil, retryBuf.Bytes())
+	} else {
+		if retryAEADv1 == nil {
+			retryAEADv1 = initAEAD([16]byte{0xbe, 0x0c, 0x69, 0x0b, 0x9f, 0x66, 0x57, 0x5a, 0x1d, 0x76, 0x6b, 0x54, 0xe3, 0x68, 0xc8, 0x4e})
+		}
+		sealed = retryAEADv1.Seal(tag[:0], retryNonceV1[:], nil, retryBuf.Bytes())
+	}
+	if len(sealed) != 16 {
+		panic(fmt.Sprintf("unexpected Retry integrity tag length: %d", len(sealed)))
+	}
+	return &tag
+}

vendor/github.com/quic-go/quic-go/internal/handshake/session_ticket.go

@@ -0,0 +1,56 @@
+package handshake
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+
+	"github.com/quic-go/quic-go/internal/wire"
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+const sessionTicketRevision = 5
+
+type sessionTicket struct {
+	Parameters *wire.TransportParameters
+}
+
+func (t *sessionTicket) Marshal() []byte {
+	b := make([]byte, 0, 256)
+	b = quicvarint.Append(b, sessionTicketRevision)
+	return t.Parameters.MarshalForSessionTicket(b)
+}
+
+func (t *sessionTicket) Unmarshal(b []byte) error {
+	rev, l, err := quicvarint.Parse(b)
+	if err != nil {
+		return errors.New("failed to read session ticket revision")
+	}
+	b = b[l:]
+	if rev != sessionTicketRevision {
+		return fmt.Errorf("unknown session ticket revision: %d", rev)
+	}
+	var tp wire.TransportParameters
+	if err := tp.UnmarshalFromSessionTicket(b); err != nil {
+		return fmt.Errorf("unmarshaling transport parameters from session ticket failed: %s", err.Error())
+	}
+	t.Parameters = &tp
+	return nil
+}
+
+const extraPrefix = "quic-go1"
+
+func addSessionStateExtraPrefix(b []byte) []byte {
+	return append([]byte(extraPrefix), b...)
+}
+
+func findSessionStateExtraData(extras [][]byte) []byte {
+	prefix := []byte(extraPrefix)
+	for _, extra := range extras {
+		if len(extra) < len(prefix) || !bytes.Equal(prefix, extra[:len(prefix)]) {
+			continue
+		}
+		return extra[len(prefix):]
+	}
+	return nil
+}

vendor/github.com/quic-go/quic-go/internal/handshake/tls_config.go

@@ -0,0 +1,39 @@
+package handshake
+
+import (
+	"crypto/tls"
+	"net"
+)
+
+func setupConfigForServer(conf *tls.Config, localAddr, remoteAddr net.Addr) *tls.Config {
+	// Workaround for https://github.com/golang/go/issues/60506.
+	// This initializes the session tickets _before_ cloning the config.
+	_, _ = conf.DecryptTicket(nil, tls.ConnectionState{})
+
+	conf = conf.Clone()
+	conf.MinVersion = tls.VersionTLS13
+
+	// The tls.Config contains two callbacks that pass in a tls.ClientHelloInfo.
+	// Since crypto/tls doesn't do it, we need to make sure to set the Conn field with a fake net.Conn
+	// that allows the caller to get the local and the remote address.
+	if conf.GetConfigForClient != nil {
+		gcfc := conf.GetConfigForClient
+		conf.GetConfigForClient = func(info *tls.ClientHelloInfo) (*tls.Config, error) {
+			info.Conn = &conn{localAddr: localAddr, remoteAddr: remoteAddr}
+			c, err := gcfc(info)
+			if c != nil {
+				// we're returning a tls.Config here, so we need to apply this recursively
+				c = setupConfigForServer(c, localAddr, remoteAddr)
+			}
+			return c, err
+		}
+	}
+	if conf.GetCertificate != nil {
+		gc := conf.GetCertificate
+		conf.GetCertificate = func(info *tls.ClientHelloInfo) (*tls.Certificate, error) {
+			info.Conn = &conn{localAddr: localAddr, remoteAddr: remoteAddr}
+			return gc(info)
+		}
+	}
+	return conf
+}

vendor/github.com/quic-go/quic-go/internal/handshake/token_generator.go

@@ -0,0 +1,126 @@
+package handshake
+
+import (
+	"bytes"
+	"encoding/asn1"
+	"fmt"
+	"net"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+)
+
+const (
+	tokenPrefixIP byte = iota
+	tokenPrefixString
+)
+
+// A Token is derived from the client address and can be used to verify the ownership of this address.
+type Token struct {
+	IsRetryToken      bool
+	SentTime          time.Time
+	encodedRemoteAddr []byte
+	// only set for tokens sent in NEW_TOKEN frames
+	RTT time.Duration
+	// only set for retry tokens
+	OriginalDestConnectionID protocol.ConnectionID
+	RetrySrcConnectionID     protocol.ConnectionID
+}
+
+// ValidateRemoteAddr validates the address, but does not check expiration
+func (t *Token) ValidateRemoteAddr(addr net.Addr) bool {
+	return bytes.Equal(encodeRemoteAddr(addr), t.encodedRemoteAddr)
+}
+
+// token is the struct that is used for ASN1 serialization and deserialization
+type token struct {
+	IsRetryToken             bool
+	RemoteAddr               []byte
+	Timestamp                int64
+	RTT                      int64 // in mus
+	OriginalDestConnectionID []byte
+	RetrySrcConnectionID     []byte
+}
+
+// A TokenGenerator generates tokens
+type TokenGenerator struct {
+	tokenProtector tokenProtector
+}
+
+// NewTokenGenerator initializes a new TokenGenerator
+func NewTokenGenerator(key TokenProtectorKey) *TokenGenerator {
+	return &TokenGenerator{tokenProtector: *newTokenProtector(key)}
+}
+
+// NewRetryToken generates a new token for a Retry for a given source address
+func (g *TokenGenerator) NewRetryToken(
+	raddr net.Addr,
+	origDestConnID protocol.ConnectionID,
+	retrySrcConnID protocol.ConnectionID,
+) ([]byte, error) {
+	data, err := asn1.Marshal(token{
+		IsRetryToken:             true,
+		RemoteAddr:               encodeRemoteAddr(raddr),
+		OriginalDestConnectionID: origDestConnID.Bytes(),
+		RetrySrcConnectionID:     retrySrcConnID.Bytes(),
+		Timestamp:                time.Now().UnixNano(),
+	})
+	if err != nil {
+		return nil, err
+	}
+	return g.tokenProtector.NewToken(data)
+}
+
+// NewToken generates a new token to be sent in a NEW_TOKEN frame
+func (g *TokenGenerator) NewToken(raddr net.Addr, rtt time.Duration) ([]byte, error) {
+	data, err := asn1.Marshal(token{
+		RemoteAddr: encodeRemoteAddr(raddr),
+		Timestamp:  time.Now().UnixNano(),
+		RTT:        rtt.Microseconds(),
+	})
+	if err != nil {
+		return nil, err
+	}
+	return g.tokenProtector.NewToken(data)
+}
+
+// DecodeToken decodes a token
+func (g *TokenGenerator) DecodeToken(encrypted []byte) (*Token, error) {
+	// if the client didn't send any token, DecodeToken will be called with a nil-slice
+	if len(encrypted) == 0 {
+		return nil, nil
+	}
+
+	data, err := g.tokenProtector.DecodeToken(encrypted)
+	if err != nil {
+		return nil, err
+	}
+	t := &token{}
+	rest, err := asn1.Unmarshal(data, t)
+	if err != nil {
+		return nil, err
+	}
+	if len(rest) != 0 {
+		return nil, fmt.Errorf("rest when unpacking token: %d", len(rest))
+	}
+	token := &Token{
+		IsRetryToken:      t.IsRetryToken,
+		SentTime:          time.Unix(0, t.Timestamp),
+		encodedRemoteAddr: t.RemoteAddr,
+	}
+	if t.IsRetryToken {
+		token.OriginalDestConnectionID = protocol.ParseConnectionID(t.OriginalDestConnectionID)
+		token.RetrySrcConnectionID = protocol.ParseConnectionID(t.RetrySrcConnectionID)
+	} else {
+		token.RTT = time.Duration(t.RTT) * time.Microsecond
+	}
+	return token, nil
+}
+
+// encodeRemoteAddr encodes a remote address such that it can be saved in the token
+func encodeRemoteAddr(remoteAddr net.Addr) []byte {
+	if udpAddr, ok := remoteAddr.(*net.UDPAddr); ok {
+		return append([]byte{tokenPrefixIP}, udpAddr.IP...)
+	}
+	return append([]byte{tokenPrefixString}, []byte(remoteAddr.String())...)
+}

vendor/github.com/quic-go/quic-go/internal/handshake/token_protector.go

@@ -0,0 +1,74 @@
+package handshake
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"crypto/sha256"
+	"fmt"
+	"io"
+
+	"golang.org/x/crypto/hkdf"
+)
+
+// TokenProtectorKey is the key used to encrypt both Retry and session resumption tokens.
+type TokenProtectorKey [32]byte
+
+const tokenNonceSize = 32
+
+// tokenProtector is used to create and verify a token
+type tokenProtector struct {
+	key TokenProtectorKey
+}
+
+// newTokenProtector creates a source for source address tokens
+func newTokenProtector(key TokenProtectorKey) *tokenProtector {
+	return &tokenProtector{key: key}
+}
+
+// NewToken encodes data into a new token.
+func (s *tokenProtector) NewToken(data []byte) ([]byte, error) {
+	var nonce [tokenNonceSize]byte
+	if _, err := rand.Read(nonce[:]); err != nil {
+		return nil, err
+	}
+	aead, aeadNonce, err := s.createAEAD(nonce[:])
+	if err != nil {
+		return nil, err
+	}
+	return append(nonce[:], aead.Seal(nil, aeadNonce, data, nil)...), nil
+}
+
+// DecodeToken decodes a token.
+func (s *tokenProtector) DecodeToken(p []byte) ([]byte, error) {
+	if len(p) < tokenNonceSize {
+		return nil, fmt.Errorf("token too short: %d", len(p))
+	}
+	nonce := p[:tokenNonceSize]
+	aead, aeadNonce, err := s.createAEAD(nonce)
+	if err != nil {
+		return nil, err
+	}
+	return aead.Open(nil, aeadNonce, p[tokenNonceSize:], nil)
+}
+
+func (s *tokenProtector) createAEAD(nonce []byte) (cipher.AEAD, []byte, error) {
+	h := hkdf.New(sha256.New, s.key[:], nonce, []byte("quic-go token source"))
+	key := make([]byte, 32) // use a 32 byte key, in order to select AES-256
+	if _, err := io.ReadFull(h, key); err != nil {
+		return nil, nil, err
+	}
+	aeadNonce := make([]byte, 12)
+	if _, err := io.ReadFull(h, aeadNonce); err != nil {
+		return nil, nil, err
+	}
+	c, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, nil, err
+	}
+	aead, err := cipher.NewGCM(c)
+	if err != nil {
+		return nil, nil, err
+	}
+	return aead, aeadNonce, nil
+}

vendor/github.com/quic-go/quic-go/internal/handshake/updatable_aead.go

@@ -0,0 +1,372 @@
+package handshake
+
+import (
+	"crypto"
+	"crypto/cipher"
+	"crypto/tls"
+	"encoding/binary"
+	"fmt"
+	"sync/atomic"
+
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+)
+
+var keyUpdateInterval atomic.Uint64
+
+func init() {
+	keyUpdateInterval.Store(protocol.KeyUpdateInterval)
+}
+
+func SetKeyUpdateInterval(v uint64) (reset func()) {
+	old := keyUpdateInterval.Swap(v)
+	return func() { keyUpdateInterval.Store(old) }
+}
+
+// FirstKeyUpdateInterval is the maximum number of packets we send or receive before initiating the first key update.
+// It's a package-level variable to allow modifying it for testing purposes.
+var FirstKeyUpdateInterval uint64 = 100
+
+type updatableAEAD struct {
+	suite cipherSuite
+
+	keyPhase           protocol.KeyPhase
+	largestAcked       protocol.PacketNumber
+	firstPacketNumber  protocol.PacketNumber
+	handshakeConfirmed bool
+
+	invalidPacketLimit uint64
+	invalidPacketCount uint64
+
+	// Time when the keys should be dropped. Keys are dropped on the next call to Open().
+	prevRcvAEADExpiry monotime.Time
+	prevRcvAEAD       cipher.AEAD
+
+	firstRcvdWithCurrentKey protocol.PacketNumber
+	firstSentWithCurrentKey protocol.PacketNumber
+	highestRcvdPN           protocol.PacketNumber // highest packet number received (which could be successfully unprotected)
+	numRcvdWithCurrentKey   uint64
+	numSentWithCurrentKey   uint64
+	rcvAEAD                 cipher.AEAD
+	sendAEAD                cipher.AEAD
+	// caches cipher.AEAD.Overhead(). This speeds up calls to Overhead().
+	aeadOverhead int
+
+	nextRcvAEAD           cipher.AEAD
+	nextSendAEAD          cipher.AEAD
+	nextRcvTrafficSecret  []byte
+	nextSendTrafficSecret []byte
+
+	headerDecrypter headerProtector
+	headerEncrypter headerProtector
+
+	rttStats *utils.RTTStats
+
+	qlogger qlogwriter.Recorder
+	logger  utils.Logger
+	version protocol.Version
+
+	// use a single slice to avoid allocations
+	nonceBuf []byte
+}
+
+var (
+	_ ShortHeaderOpener = &updatableAEAD{}
+	_ ShortHeaderSealer = &updatableAEAD{}
+)
+
+func newUpdatableAEAD(rttStats *utils.RTTStats, qlogger qlogwriter.Recorder, logger utils.Logger, version protocol.Version) *updatableAEAD {
+	return &updatableAEAD{
+		firstPacketNumber:       protocol.InvalidPacketNumber,
+		largestAcked:            protocol.InvalidPacketNumber,
+		firstRcvdWithCurrentKey: protocol.InvalidPacketNumber,
+		firstSentWithCurrentKey: protocol.InvalidPacketNumber,
+		rttStats:                rttStats,
+		qlogger:                 qlogger,
+		logger:                  logger,
+		version:                 version,
+	}
+}
+
+func (a *updatableAEAD) rollKeys() {
+	if a.prevRcvAEAD != nil {
+		a.logger.Debugf("Dropping key phase %d ahead of scheduled time. Drop time was: %s", a.keyPhase-1, a.prevRcvAEADExpiry)
+		if a.qlogger != nil {
+			a.qlogger.RecordEvent(qlog.KeyDiscarded{
+				KeyType:  qlog.KeyTypeClient1RTT,
+				KeyPhase: a.keyPhase - 1,
+			})
+			a.qlogger.RecordEvent(qlog.KeyDiscarded{
+				KeyType:  qlog.KeyTypeServer1RTT,
+				KeyPhase: a.keyPhase - 1,
+			})
+		}
+		a.prevRcvAEADExpiry = 0
+	}
+
+	a.keyPhase++
+	a.firstRcvdWithCurrentKey = protocol.InvalidPacketNumber
+	a.firstSentWithCurrentKey = protocol.InvalidPacketNumber
+	a.numRcvdWithCurrentKey = 0
+	a.numSentWithCurrentKey = 0
+	a.prevRcvAEAD = a.rcvAEAD
+	a.rcvAEAD = a.nextRcvAEAD
+	a.sendAEAD = a.nextSendAEAD
+
+	a.nextRcvTrafficSecret = a.getNextTrafficSecret(a.suite.Hash, a.nextRcvTrafficSecret)
+	a.nextSendTrafficSecret = a.getNextTrafficSecret(a.suite.Hash, a.nextSendTrafficSecret)
+	a.nextRcvAEAD = createAEAD(a.suite, a.nextRcvTrafficSecret, a.version)
+	a.nextSendAEAD = createAEAD(a.suite, a.nextSendTrafficSecret, a.version)
+}
+
+func (a *updatableAEAD) startKeyDropTimer(now monotime.Time) {
+	d := 3 * a.rttStats.PTO(true)
+	a.logger.Debugf("Starting key drop timer to drop key phase %d (in %s)", a.keyPhase-1, d)
+	a.prevRcvAEADExpiry = now.Add(d)
+}
+
+func (a *updatableAEAD) getNextTrafficSecret(hash crypto.Hash, ts []byte) []byte {
+	return hkdfExpandLabel(hash, ts, []byte{}, "quic ku", hash.Size())
+}
+
+// SetReadKey sets the read key.
+// For the client, this function is called before SetWriteKey.
+// For the server, this function is called after SetWriteKey.
+func (a *updatableAEAD) SetReadKey(suite cipherSuite, trafficSecret []byte) {
+	a.rcvAEAD = createAEAD(suite, trafficSecret, a.version)
+	a.headerDecrypter = newHeaderProtector(suite, trafficSecret, false, a.version)
+	if a.suite.ID == 0 { // suite is not set yet
+		a.setAEADParameters(a.rcvAEAD, suite)
+	}
+
+	a.nextRcvTrafficSecret = a.getNextTrafficSecret(suite.Hash, trafficSecret)
+	a.nextRcvAEAD = createAEAD(suite, a.nextRcvTrafficSecret, a.version)
+}
+
+// SetWriteKey sets the write key.
+// For the client, this function is called after SetReadKey.
+// For the server, this function is called before SetReadKey.
+func (a *updatableAEAD) SetWriteKey(suite cipherSuite, trafficSecret []byte) {
+	a.sendAEAD = createAEAD(suite, trafficSecret, a.version)
+	a.headerEncrypter = newHeaderProtector(suite, trafficSecret, false, a.version)
+	if a.suite.ID == 0 { // suite is not set yet
+		a.setAEADParameters(a.sendAEAD, suite)
+	}
+
+	a.nextSendTrafficSecret = a.getNextTrafficSecret(suite.Hash, trafficSecret)
+	a.nextSendAEAD = createAEAD(suite, a.nextSendTrafficSecret, a.version)
+}
+
+func (a *updatableAEAD) setAEADParameters(aead cipher.AEAD, suite cipherSuite) {
+	a.nonceBuf = make([]byte, aead.NonceSize())
+	a.aeadOverhead = aead.Overhead()
+	a.suite = suite
+	switch suite.ID {
+	case tls.TLS_AES_128_GCM_SHA256, tls.TLS_AES_256_GCM_SHA384:
+		a.invalidPacketLimit = protocol.InvalidPacketLimitAES
+	case tls.TLS_CHACHA20_POLY1305_SHA256:
+		a.invalidPacketLimit = protocol.InvalidPacketLimitChaCha
+	default:
+		panic(fmt.Sprintf("unknown cipher suite %d", suite.ID))
+	}
+}
+
+func (a *updatableAEAD) DecodePacketNumber(wirePN protocol.PacketNumber, wirePNLen protocol.PacketNumberLen) protocol.PacketNumber {
+	return protocol.DecodePacketNumber(wirePNLen, a.highestRcvdPN, wirePN)
+}
+
+func (a *updatableAEAD) Open(dst, src []byte, rcvTime monotime.Time, pn protocol.PacketNumber, kp protocol.KeyPhaseBit, ad []byte) ([]byte, error) {
+	dec, err := a.open(dst, src, rcvTime, pn, kp, ad)
+	if err == ErrDecryptionFailed {
+		a.invalidPacketCount++
+		if a.invalidPacketCount >= a.invalidPacketLimit {
+			return nil, &qerr.TransportError{ErrorCode: qerr.AEADLimitReached}
+		}
+	}
+	if err == nil {
+		a.highestRcvdPN = max(a.highestRcvdPN, pn)
+	}
+	return dec, err
+}
+
+func (a *updatableAEAD) open(dst, src []byte, rcvTime monotime.Time, pn protocol.PacketNumber, kp protocol.KeyPhaseBit, ad []byte) ([]byte, error) {
+	if a.prevRcvAEAD != nil && !a.prevRcvAEADExpiry.IsZero() && rcvTime.After(a.prevRcvAEADExpiry) {
+		a.prevRcvAEAD = nil
+		a.logger.Debugf("Dropping key phase %d", a.keyPhase-1)
+		a.prevRcvAEADExpiry = 0
+		if a.qlogger != nil {
+			a.qlogger.RecordEvent(qlog.KeyDiscarded{
+				KeyType:  qlog.KeyTypeClient1RTT,
+				KeyPhase: a.keyPhase - 1,
+			})
+			a.qlogger.RecordEvent(qlog.KeyDiscarded{
+				KeyType:  qlog.KeyTypeServer1RTT,
+				KeyPhase: a.keyPhase - 1,
+			})
+		}
+	}
+	binary.BigEndian.PutUint64(a.nonceBuf[len(a.nonceBuf)-8:], uint64(pn))
+	if kp != a.keyPhase.Bit() {
+		if a.keyPhase > 0 && a.firstRcvdWithCurrentKey == protocol.InvalidPacketNumber || pn < a.firstRcvdWithCurrentKey {
+			if a.prevRcvAEAD == nil {
+				return nil, ErrKeysDropped
+			}
+			// we updated the key, but the peer hasn't updated yet
+			dec, err := a.prevRcvAEAD.Open(dst, a.nonceBuf, src, ad)
+			if err != nil {
+				err = ErrDecryptionFailed
+			}
+			return dec, err
+		}
+		// try opening the packet with the next key phase
+		dec, err := a.nextRcvAEAD.Open(dst, a.nonceBuf, src, ad)
+		if err != nil {
+			return nil, ErrDecryptionFailed
+		}
+		// Opening succeeded. Check if the peer was allowed to update.
+		if a.keyPhase > 0 && a.firstSentWithCurrentKey == protocol.InvalidPacketNumber {
+			return nil, &qerr.TransportError{
+				ErrorCode:    qerr.KeyUpdateError,
+				ErrorMessage: "keys updated too quickly",
+			}
+		}
+		a.rollKeys()
+		a.logger.Debugf("Peer updated keys to %d", a.keyPhase)
+		// The peer initiated this key update. It's safe to drop the keys for the previous generation now.
+		// Start a timer to drop the previous key generation.
+		a.startKeyDropTimer(rcvTime)
+		if a.qlogger != nil {
+			a.qlogger.RecordEvent(qlog.KeyUpdated{
+				Trigger:  qlog.KeyUpdateRemote,
+				KeyType:  qlog.KeyTypeClient1RTT,
+				KeyPhase: a.keyPhase,
+			})
+			a.qlogger.RecordEvent(qlog.KeyUpdated{
+				Trigger:  qlog.KeyUpdateRemote,
+				KeyType:  qlog.KeyTypeServer1RTT,
+				KeyPhase: a.keyPhase,
+			})
+		}
+		a.firstRcvdWithCurrentKey = pn
+		return dec, err
+	}
+	// The AEAD we're using here will be the qtls.aeadAESGCM13.
+	// It uses the nonce provided here and XOR it with the IV.
+	dec, err := a.rcvAEAD.Open(dst, a.nonceBuf, src, ad)
+	if err != nil {
+		return dec, ErrDecryptionFailed
+	}
+	a.numRcvdWithCurrentKey++
+	if a.firstRcvdWithCurrentKey == protocol.InvalidPacketNumber {
+		// We initiated the key updated, and now we received the first packet protected with the new key phase.
+		// Therefore, we are certain that the peer rolled its keys as well. Start a timer to drop the old keys.
+		if a.keyPhase > 0 {
+			a.logger.Debugf("Peer confirmed key update to phase %d", a.keyPhase)
+			a.startKeyDropTimer(rcvTime)
+		}
+		a.firstRcvdWithCurrentKey = pn
+	}
+	return dec, err
+}
+
+func (a *updatableAEAD) Seal(dst, src []byte, pn protocol.PacketNumber, ad []byte) []byte {
+	if a.firstSentWithCurrentKey == protocol.InvalidPacketNumber {
+		a.firstSentWithCurrentKey = pn
+	}
+	if a.firstPacketNumber == protocol.InvalidPacketNumber {
+		a.firstPacketNumber = pn
+	}
+	a.numSentWithCurrentKey++
+	binary.BigEndian.PutUint64(a.nonceBuf[len(a.nonceBuf)-8:], uint64(pn))
+	// The AEAD we're using here will be the qtls.aeadAESGCM13.
+	// It uses the nonce provided here and XOR it with the IV.
+	return a.sendAEAD.Seal(dst, a.nonceBuf, src, ad)
+}
+
+func (a *updatableAEAD) SetLargestAcked(pn protocol.PacketNumber) error {
+	if a.firstSentWithCurrentKey != protocol.InvalidPacketNumber &&
+		pn >= a.firstSentWithCurrentKey && a.numRcvdWithCurrentKey == 0 {
+		return &qerr.TransportError{
+			ErrorCode:    qerr.KeyUpdateError,
+			ErrorMessage: fmt.Sprintf("received ACK for key phase %d, but peer didn't update keys", a.keyPhase),
+		}
+	}
+	a.largestAcked = pn
+	return nil
+}
+
+func (a *updatableAEAD) SetHandshakeConfirmed() {
+	a.handshakeConfirmed = true
+}
+
+func (a *updatableAEAD) updateAllowed() bool {
+	if !a.handshakeConfirmed {
+		return false
+	}
+	// the first key update is allowed as soon as the handshake is confirmed
+	return a.keyPhase == 0 ||
+		// subsequent key updates as soon as a packet sent with that key phase has been acknowledged
+		(a.firstSentWithCurrentKey != protocol.InvalidPacketNumber &&
+			a.largestAcked != protocol.InvalidPacketNumber &&
+			a.largestAcked >= a.firstSentWithCurrentKey)
+}
+
+func (a *updatableAEAD) shouldInitiateKeyUpdate() bool {
+	if !a.updateAllowed() {
+		return false
+	}
+	// Initiate the first key update shortly after the handshake, in order to exercise the key update mechanism.
+	if a.keyPhase == 0 {
+		if a.numRcvdWithCurrentKey >= FirstKeyUpdateInterval || a.numSentWithCurrentKey >= FirstKeyUpdateInterval {
+			return true
+		}
+	}
+	if a.numRcvdWithCurrentKey >= keyUpdateInterval.Load() {
+		a.logger.Debugf("Received %d packets with current key phase. Initiating key update to the next key phase: %d", a.numRcvdWithCurrentKey, a.keyPhase+1)
+		return true
+	}
+	if a.numSentWithCurrentKey >= keyUpdateInterval.Load() {
+		a.logger.Debugf("Sent %d packets with current key phase. Initiating key update to the next key phase: %d", a.numSentWithCurrentKey, a.keyPhase+1)
+		return true
+	}
+	return false
+}
+
+func (a *updatableAEAD) KeyPhase() protocol.KeyPhaseBit {
+	if a.shouldInitiateKeyUpdate() {
+		a.rollKeys()
+		if a.qlogger != nil {
+			a.qlogger.RecordEvent(qlog.KeyUpdated{
+				Trigger:  qlog.KeyUpdateLocal,
+				KeyType:  qlog.KeyTypeClient1RTT,
+				KeyPhase: a.keyPhase,
+			})
+			a.qlogger.RecordEvent(qlog.KeyUpdated{
+				Trigger:  qlog.KeyUpdateLocal,
+				KeyType:  qlog.KeyTypeServer1RTT,
+				KeyPhase: a.keyPhase,
+			})
+		}
+	}
+	return a.keyPhase.Bit()
+}
+
+func (a *updatableAEAD) Overhead() int {
+	return a.aeadOverhead
+}
+
+func (a *updatableAEAD) EncryptHeader(sample []byte, firstByte *byte, hdrBytes []byte) {
+	a.headerEncrypter.EncryptHeader(sample, firstByte, hdrBytes)
+}
+
+func (a *updatableAEAD) DecryptHeader(sample []byte, firstByte *byte, hdrBytes []byte) {
+	a.headerDecrypter.DecryptHeader(sample, firstByte, hdrBytes)
+}
+
+func (a *updatableAEAD) FirstPacketNumber() protocol.PacketNumber {
+	return a.firstPacketNumber
+}