// The TLS 1.3 handshake transcript hash (RFC 8446 §4.4.1) and the Finished verify_data
// (§4.4.4). A handshake progresses by feeding each message into a running hash; at the
// points a Finished is sent or checked, verify_data is HMAC(finished_key, transcript
// hash), where finished_key is derived from the sender's traffic secret. This is the
// accumulator and MAC the handshake driver keeps as it advances through the messages.

///|
/// A running transcript hash over the handshake messages seen so far.
pub struct TranscriptHash {
  messages : Buffer
}

///|
/// A fresh, empty transcript.
pub fn TranscriptHash::new() -> TranscriptHash {
  { messages: Buffer(), }
}

///|
/// Append a handshake message (its full `HandshakeType + Length + body` encoding) to the
/// transcript.
pub fn TranscriptHash::add(self : TranscriptHash, message : Bytes) -> Unit {
  self.messages.write_bytes(message)
}

///|
/// The SHA-256 transcript hash over every message added so far (RFC 8446 §4.4.1).
pub fn TranscriptHash::hash(self : TranscriptHash) -> Bytes {
  sha256(self.messages.to_bytes())
}

///|
/// The Finished verify_data (RFC 8446 §4.4.4): `HMAC(finished_key, transcript_hash)`,
/// where `finished_key` is `HKDF-Expand-Label(base_key, "finished", "", Hash.length)`
/// over the sender's handshake traffic secret.
pub fn tls13_finished_verify_data(
  base_key : Bytes,
  transcript_hash : Bytes,
) -> Bytes {
  hmac_sha256(tls13_finished_key(base_key), transcript_hash)
}

///|
/// Whether a received Finished's `verify_data` is the one expected for `base_key` over
/// `transcript_hash` — a constant set membership, the handshake authentication check.
pub fn tls13_finished_verify(
  base_key : Bytes,
  transcript_hash : Bytes,
  verify_data : Bytes,
) -> Bool {
  tls13_finished_verify_data(base_key, transcript_hash) == verify_data
}