For TLS 1.3 only ever track the PRF hash
@@ -65,7 +65,9 @@ public void forceBuffering()
public void notifyPRFDetermined()
{
- int prfAlgorithm = context.getSecurityParametersHandshake().getPrfAlgorithm();
+ SecurityParameters securityParameters = context.getSecurityParametersHandshake();
+
+ int prfAlgorithm = securityParameters.getPrfAlgorithm();
switch (prfAlgorithm)
{
case PRFAlgorithm.ssl_prf_legacy:
@@ -78,6 +80,10 @@ public void notifyPRFDetermined()
default:
{
checkTrackingHash(Shorts.valueOf(TlsUtils.getHashAlgorithmForPRFAlgorithm(prfAlgorithm)));
+ if (TlsUtils.isTLSv13(securityParameters.getNegotiatedVersion()))
+ {
+ sealHashAlgorithms();
+ }
break;
}
}
@@ -95,11 +101,13 @@ public void trackHashAlgorithm(short hashAlgorithm)
public void sealHashAlgorithms()
{
- if (!sealed)
+ if (sealed)
{
- sealed = true;
- checkStopBuffering();
+ throw new IllegalStateException("Already sealed");
}
+
+ this.sealed = true;
+ checkStopBuffering();
}
public TlsHandshakeHash stopTracking()
