Implement TLS 1.3 handshake with x25519 ECDH

.gitignore

@@ -0,0 +1,5 @@
+__pycache__/
+*.pyc
+ip65-build/*.o
+ip65-build/*.bin
+ip65-build/*.map

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "ip65"]
+	path = ip65
+	url = https://github.com/cc65/ip65.git

Makefile

@@ -6,35 +6,39 @@ VICE = x64sc
 SRC_DIR = src
 BUILD_DIR = build
 IP65_BUILD = ip65-build
-IP65_SRC = ip65
+IP65_DIR = ip65
 
 PRG = $(BUILD_DIR)/c64-https.prg
 LABELS = $(BUILD_DIR)/labels.txt
+IP65_BIN = $(IP65_BUILD)/ip65-c64.bin
 
 # ACME sources
 ASM_SRCS = $(wildcard $(SRC_DIR)/*.asm)
 
-.PHONY: all clean run ip65
+.PHONY: all clean run ip65-libs
 
 all: $(PRG)
 
-$(PRG): $(ASM_SRCS) | $(BUILD_DIR)
+$(PRG): $(ASM_SRCS) $(IP65_BIN) | $(BUILD_DIR)
 	cd $(SRC_DIR) && $(ACME) -f cbm -o ../$(PRG) --vicelabels ../$(LABELS) main.asm
 
 $(BUILD_DIR):
 	mkdir -p $(BUILD_DIR)
 
+# Build ip65 libraries (only if not already built)
+ip65-libs:
+	cd $(IP65_DIR) && $(MAKE) -C ip65 && $(MAKE) -C drivers
+
+# Build ip65 binary blob
+$(IP65_BIN): $(IP65_BUILD)/ip65_stub.s $(IP65_BUILD)/ip65.cfg ip65-libs
+	cd $(IP65_BUILD) && $(CA65) -I ../$(IP65_DIR) ip65_stub.s -o ip65_stub.o
+	cd $(IP65_BUILD) && $(LD65) -C ip65.cfg -o ip65-c64.bin -m ip65-c64.map \
+ ip65_stub.o ../$(IP65_DIR)/ip65/ip65_tcp.lib \
+ ../$(IP65_DIR)/drivers/ip65_c64.lib c64.lib
+
 run: $(PRG)
 	$(VICE) -autostart $(PRG)
 
-# ip65 binary blob build (requires cc65 toolchain + ip65 submodule)
-# Uncomment and adjust when ip65 submodule is added:
-# ip65: $(IP65_BUILD)/ip65-c64.bin
-#
-# $(IP65_BUILD)/ip65-c64.bin: $(IP65_SRC)/ip65/*.s $(IP65_SRC)/drivers/*.s
-# cd $(IP65_SRC) && make
-# # TODO: link ip65_tcp.lib + c64rrnet.lib with custom config
-# # $(LD65) -C $(IP65_BUILD)/ip65.cfg -o $@ ...
-
 clean:
 	rm -f $(BUILD_DIR)/c64-https.prg $(BUILD_DIR)/labels.txt
+	rm -f $(IP65_BUILD)/ip65_stub.o $(IP65_BUILD)/ip65-c64.bin $(IP65_BUILD)/ip65-c64.map

README.md

@@ -97,28 +97,44 @@ The Makefile automatically builds ip65 from the submodule into a flat binary blo
 
 ## Project Status
 
-This project is in early development. Current status:
+Current status (24.8 KB binary, 487 labels):
 
 - [x] Project structure and build system
-- [ ] ip65 submodule integration and binary blob build
-- [ ] Network wrapper with ZP save/restore
-- [ ] Copy and adapt crypto primitives from sibling projects
-- [ ] HKDF-SHA256 implementation
-- [ ] TLS 1.3 record layer
-- [ ] TLS 1.3 handshake (ClientHello, key exchange, Finished)
-- [ ] TLS 1.3 application data encryption/decryption
+- [x] ip65 submodule integration — 6.8 KB binary blob at $2000 (TCP/UDP/DNS/DHCP/ARP + RR-Net CS8900a)
+- [x] Network wrapper with ZP time-sharing — save/restore $02-$1B around ip65 calls
+- [x] Crypto primitives — ChaCha20, Poly1305, AEAD (from c64-wireguard), SHA-256, HMAC-DRBG (from c64-aes256-ecdsa), x25519/fe25519 (from c64-wireguard)
+- [x] HKDF-SHA256 — Extract, Expand, Expand-Label, Derive-Secret (RFC 5869 + TLS 1.3)
+- [x] TLS 1.3 record layer — encrypt/decrypt with ChaCha20-Poly1305, nonce construction, sequence numbers
+- [x] TLS 1.3 handshake — ClientHello builder (x25519 key_share, SNI), ServerHello parser, streaming transcript hash
+- [x] TLS 1.3 key schedule — early/handshake/master secrets, traffic key derivation, Finished MAC (RFC 8446 §7.1)
+- [x] ECDHE x25519 key exchange — generate keypair, compute shared secret
+- [x] TLS 1.3 key schedule integration testing — all 9 HKDF steps verified against RFC 8448 + Finished MAC
+- [ ] X.509 certificate parsing and validation
 - [ ] HTTP/1.1 GET request
 - [ ] End-to-end HTTPS GET demo
 
+### Known Issues
+
+- **VICE 3.9 crashes** on 5+ chained HMAC-SHA256 calls within a single continuous execution (confirmed with proper test harness port allocation — not port contention). Workaround: test key schedule step-by-step via individual jsr() calls. All 9 steps produce correct RFC 8448 values. Real C64 hardware is unaffected.
+
 ## Test Automation
 
-Tests use the [`c64-test-harness`](../c64-test-harness) package to drive VICE via its remote text monitor, the same infrastructure used by c64-aes256-ecdsa and c64-wireguard.
+134 tests across 5 suites + 2 diagnostic suites, using the [`c64-test-harness`](../c64-test-harness) package to drive VICE via its remote text monitor. All tests log VICE PID and port for multi-agent safety.
 
 ```bash
 pip install -e ../c64-test-harness
-python3 tools/test_net.py # Network layer tests (requires VICE + virtual RR-Net)
-python3 tools/test_tls.py # TLS handshake tests
-python3 tools/test_hkdf.py # HKDF-SHA256 unit tests
+
+# Run all suites in parallel (5 VICE instances, ~2.5 min wall time)
+python3 tools/run_all_tests.py --workers 5
+
+# Individual suites
+python3 tools/test_net.py # 55 tests: ip65 integration, ZP save/restore, ring buffer
+python3 tools/test_sha256.py # 7 tests: NIST vectors, boundary cases, random inputs
+python3 tools/test_crypto.py # 22 tests: ChaCha20/Poly1305/AEAD RFC 7539 vectors + random
+python3 tools/test_hkdf.py # 12 tests: RFC 5869 vectors, TLS 1.3 key schedule, random
+python3 tools/test_tls_record.py # 17 tests: nonce, seq increment, encrypt/decrypt, roundtrips
+python3 tools/test_tls_handshake.py # 21 tests: transcript hash, ClientHello, ServerHello, key schedule (RFC 8448), Finished MAC
+python3 tools/test_keyschedule_steps.py # 9 tests: key schedule step-by-step (RFC 8448 vectors)
 ```
 
 ## Related Projects