test: fill all 60 empty test suites with meaningful tests

monopam (399 tests, 0.26s):
- Pure modules: opam_transform, mono_lock, changes, changes_aggregated,
import, forks, cross_status, doctor, diff, fork_join, verse
- I/O modules: ctx, git_cli, opam_repo, feature, progress helpers

ocaml-claudeio (246 tests, 0.03s):
- Codec roundtrips: model, tool_input, err, permissions, control,
sdk_control, structured_output, content_block, message, incoming
- Builder patterns: options (17 with_* builders), hooks (4 event types)
- Pure helpers: handler dispatch, mcp_server, server_info, response

ocaml-tls (91 new tests, 0.05s):
- RFC 8446 test vectors: TLS 1.3 key schedule (early/handshake/master
secrets, traffic keys, finished keys, HKDF-Expand-Label)
- RFC 5246: TLS 1.2 PRF output length, label sensitivity, finished
computation (12 bytes per Section 7.4.9)
- Ciphersuite params: key/nonce lengths, hash mappings, forward secrecy
- Handshake validation: client_hello construction, server_hello_valid,
extension checks, ALPN negotiation, signature algorithm filtering
- Utils: List_set operations, sub_equal, init_and_last, first_match

test/test_ciphersuite.ml

···
-let () = ()
-let suite = ("ciphersuite", [])
+open Tls
+
+(* Test key_length for AEAD ciphers (TLS 1.2 style, iv=Some) *)
+let key_length_aead_128_gcm () =
+  (* RFC 5288 Section 3: AES-128-GCM uses 16-byte key, 4-byte salt/IV, 0 mac *)
+  let key, iv, mac =
+    Ciphersuite.key_length (Some ()) (`AEAD Ciphersuite.AES_128_GCM)
+  in
+  Alcotest.(check int) "AES-128-GCM key" 16 key;
+  Alcotest.(check int) "AES-128-GCM iv" 4 iv;
+  Alcotest.(check int) "AES-128-GCM mac" 0 mac
+
+let key_length_aead_256_gcm () =
+  let key, iv, mac =
+    Ciphersuite.key_length (Some ()) (`AEAD Ciphersuite.AES_256_GCM)
+  in
+  Alcotest.(check int) "AES-256-GCM key" 32 key;
+  Alcotest.(check int) "AES-256-GCM iv" 4 iv;
+  Alcotest.(check int) "AES-256-GCM mac" 0 mac
+
+let key_length_aead_128_ccm () =
+  let key, iv, mac =
+    Ciphersuite.key_length (Some ()) (`AEAD Ciphersuite.AES_128_CCM)
+  in
+  Alcotest.(check int) "AES-128-CCM key" 16 key;
+  Alcotest.(check int) "AES-128-CCM iv" 4 iv;
+  Alcotest.(check int) "AES-128-CCM mac" 0 mac
+
+let key_length_aead_256_ccm () =
+  let key, iv, mac =
+    Ciphersuite.key_length (Some ()) (`AEAD Ciphersuite.AES_256_CCM)
+  in
+  Alcotest.(check int) "AES-256-CCM key" 32 key;
+  Alcotest.(check int) "AES-256-CCM iv" 4 iv;
+  Alcotest.(check int) "AES-256-CCM mac" 0 mac
+
+let key_length_aead_chacha20 () =
+  (* RFC 7905: ChaCha20-Poly1305 uses 32-byte key, 12-byte nonce *)
+  let key, iv, mac =
+    Ciphersuite.key_length (Some ()) (`AEAD Ciphersuite.CHACHA20_POLY1305)
+  in
+  Alcotest.(check int) "CHACHA20 key" 32 key;
+  Alcotest.(check int) "CHACHA20 iv" 12 iv;
+  Alcotest.(check int) "CHACHA20 mac" 0 mac
+
+(* Test key_length for block ciphers *)
+let key_length_3des_sha1 () =
+  let key, iv, mac =
+    Ciphersuite.key_length (Some ())
+      (`Block (Ciphersuite.TRIPLE_DES_EDE_CBC, `SHA1))
+  in
+  Alcotest.(check int) "3DES key" 24 key;
+  Alcotest.(check int) "3DES iv" 8 iv;
+  Alcotest.(check int) "SHA1 mac" 20 mac
+
+let key_length_aes128_sha256 () =
+  let key, iv, mac =
+    Ciphersuite.key_length (Some ()) (`Block (Ciphersuite.AES_128_CBC, `SHA256))
+  in
+  Alcotest.(check int) "AES-128 key" 16 key;
+  Alcotest.(check int) "AES-128 iv" 16 iv;
+  Alcotest.(check int) "SHA256 mac" 32 mac
+
+let key_length_aes256_sha1 () =
+  let key, iv, mac =
+    Ciphersuite.key_length (Some ()) (`Block (Ciphersuite.AES_256_CBC, `SHA1))
+  in
+  Alcotest.(check int) "AES-256 key" 32 key;
+  Alcotest.(check int) "AES-256 iv" 16 iv;
+  Alcotest.(check int) "SHA1 mac" 20 mac
+
+(* Test key_length with iv=None (TLS 1.0 style) *)
+let key_length_no_iv () =
+  let key, iv, mac =
+    Ciphersuite.key_length None (`Block (Ciphersuite.AES_128_CBC, `SHA1))
+  in
+  Alcotest.(check int) "AES-128 key" 16 key;
+  Alcotest.(check int) "no iv" 0 iv;
+  Alcotest.(check int) "SHA1 mac" 20 mac
+
+(* Test kn_13: TLS 1.3 key/nonce lengths per RFC 8446 Section 5.3 *)
+let kn_13_aes_128_gcm () =
+  let k, n = Ciphersuite.kn_13 Ciphersuite.AES_128_GCM in
+  Alcotest.(check int) "key len" 16 k;
+  Alcotest.(check int) "nonce len" 12 n
+
+let kn_13_aes_256_gcm () =
+  let k, n = Ciphersuite.kn_13 Ciphersuite.AES_256_GCM in
+  Alcotest.(check int) "key len" 32 k;
+  Alcotest.(check int) "nonce len" 12 n
+
+let kn_13_chacha20 () =
+  let k, n = Ciphersuite.kn_13 Ciphersuite.CHACHA20_POLY1305 in
+  Alcotest.(check int) "key len" 32 k;
+  Alcotest.(check int) "nonce len" 12 n
+
+let kn_13_aes_128_ccm () =
+  let k, n = Ciphersuite.kn_13 Ciphersuite.AES_128_CCM in
+  Alcotest.(check int) "key len" 16 k;
+  Alcotest.(check int) "nonce len" 12 n
+
+let kn_13_aes_256_ccm () =
+  let k, n = Ciphersuite.kn_13 Ciphersuite.AES_256_CCM in
+  Alcotest.(check int) "key len" 32 k;
+  Alcotest.(check int) "nonce len" 12 n
+
+(* Test hash13: hash algorithm mapping per RFC 8446 Section B.4 *)
+let hash13_aes_128_gcm_sha256 () =
+  Alcotest.(check bool)
+    "SHA256" true
+    (Ciphersuite.hash13 `AES_128_GCM_SHA256 = `SHA256)
+
+let hash13_aes_256_gcm_sha384 () =
+  Alcotest.(check bool)
+    "SHA384" true
+    (Ciphersuite.hash13 `AES_256_GCM_SHA384 = `SHA384)
+
+let hash13_chacha20_sha256 () =
+  Alcotest.(check bool)
+    "SHA256" true
+    (Ciphersuite.hash13 `CHACHA20_POLY1305_SHA256 = `SHA256)
+
+let hash13_aes_128_ccm_sha256 () =
+  Alcotest.(check bool)
+    "SHA256" true
+    (Ciphersuite.hash13 `AES_128_CCM_SHA256 = `SHA256)
+
+(* Test privprot13 *)
+let privprot13_mapping () =
+  Alcotest.(check bool)
+    "AES_128_GCM" true
+    (Ciphersuite.privprot13 `AES_128_GCM_SHA256 = Ciphersuite.AES_128_GCM);
+  Alcotest.(check bool)
+    "AES_256_GCM" true
+    (Ciphersuite.privprot13 `AES_256_GCM_SHA384 = Ciphersuite.AES_256_GCM);
+  Alcotest.(check bool)
+    "CHACHA20" true
+    (Ciphersuite.privprot13 `CHACHA20_POLY1305_SHA256
+    = Ciphersuite.CHACHA20_POLY1305);
+  Alcotest.(check bool)
+    "AES_128_CCM" true
+    (Ciphersuite.privprot13 `AES_128_CCM_SHA256 = Ciphersuite.AES_128_CCM)
+
+(* Test any_ciphersuite_to_ciphersuite roundtrip *)
+let ciphersuite_roundtrip () =
+  let suites : Ciphersuite.ciphersuite list =
+    [
+      `RSA_WITH_AES_128_CBC_SHA;
+      `DHE_RSA_WITH_AES_256_GCM_SHA384;
+      `ECDHE_RSA_WITH_AES_128_GCM_SHA256;
+      `AES_128_GCM_SHA256;
+      `AES_256_GCM_SHA384;
+      `CHACHA20_POLY1305_SHA256;
+      `ECDHE_ECDSA_WITH_AES_256_GCM_SHA384;
+    ]
+  in
+  List.iter
+    (fun cs ->
+      let any = Ciphersuite.ciphersuite_to_any_ciphersuite cs in
+      match Ciphersuite.any_ciphersuite_to_ciphersuite any with
+      | Some cs' -> Alcotest.(check bool) "roundtrip" true (cs = cs')
+      | None ->
+          Alcotest.failf "roundtrip failed for %a" Ciphersuite.pp_ciphersuite cs)
+    suites
+
+(* Test get_keytype_kex_privprot *)
+let kex_rsa () =
+  let _kt, kex, _pp =
+    Ciphersuite.get_keytype_kex_privprot `RSA_WITH_AES_128_CBC_SHA
+  in
+  Alcotest.(check bool) "RSA kex" true (kex = `RSA)
+
+let kex_dhe () =
+  let _kt, kex, _pp =
+    Ciphersuite.get_keytype_kex_privprot `DHE_RSA_WITH_AES_128_GCM_SHA256
+  in
+  Alcotest.(check bool) "FFDHE kex" true (kex = `FFDHE)
+
+let kex_ecdhe () =
+  let _kt, kex, _pp =
+    Ciphersuite.get_keytype_kex_privprot `ECDHE_RSA_WITH_AES_128_GCM_SHA256
+  in
+  Alcotest.(check bool) "ECDHE kex" true (kex = `ECDHE)
+
+let kex_ecdhe_ecdsa () =
+  let kt, kex, _pp =
+    Ciphersuite.get_keytype_kex_privprot `ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
+  in
+  Alcotest.(check bool) "ECDHE kex" true (kex = `ECDHE);
+  Alcotest.(check bool) "EC keytype" true (kt = `EC)
+
+(* Test forward secrecy classification *)
+let ciphersuite_fs_true () =
+  Alcotest.(check bool)
+    "DHE has FS" true
+    (Ciphersuite.ciphersuite_fs `DHE_RSA_WITH_AES_128_GCM_SHA256);
+  Alcotest.(check bool)
+    "ECDHE has FS" true
+    (Ciphersuite.ciphersuite_fs `ECDHE_RSA_WITH_AES_128_GCM_SHA256)
+
+let ciphersuite_fs_false () =
+  Alcotest.(check bool)
+    "RSA no FS" false
+    (Ciphersuite.ciphersuite_fs `RSA_WITH_AES_128_CBC_SHA)
+
+(* Test TLS 1.2 only classification *)
+let ciphersuite_tls12_only_true () =
+  Alcotest.(check bool)
+    "GCM is 1.2 only" true
+    (Ciphersuite.ciphersuite_tls12_only `RSA_WITH_AES_128_GCM_SHA256);
+  Alcotest.(check bool)
+    "SHA256 CBC is 1.2 only" true
+    (Ciphersuite.ciphersuite_tls12_only `RSA_WITH_AES_256_CBC_SHA256)
+
+let ciphersuite_tls12_only_false () =
+  Alcotest.(check bool)
+    "3DES SHA1 not 1.2 only" false
+    (Ciphersuite.ciphersuite_tls12_only `RSA_WITH_3DES_EDE_CBC_SHA)
+
+(* Test TLS 1.3 classification *)
+let ciphersuite_tls13_true () =
+  Alcotest.(check bool)
+    "AES_128_GCM_SHA256 is 1.3" true
+    (Ciphersuite.ciphersuite_tls13 `AES_128_GCM_SHA256);
+  Alcotest.(check bool)
+    "AES_256_GCM_SHA384 is 1.3" true
+    (Ciphersuite.ciphersuite_tls13 `AES_256_GCM_SHA384)
+
+let ciphersuite_tls13_false () =
+  Alcotest.(check bool)
+    "RSA AES not 1.3" false
+    (Ciphersuite.ciphersuite_tls13 `RSA_WITH_AES_128_CBC_SHA)
+
+(* Test required_usage *)
+let required_usage_rsa () =
+  Alcotest.(check bool)
+    "RSA requires key encipherment" true
+    (Ciphersuite.required_usage `RSA = `Key_encipherment)
+
+let required_usage_dhe () =
+  Alcotest.(check bool)
+    "DHE requires digital signature" true
+    (Ciphersuite.required_usage `FFDHE = `Digital_signature);
+  Alcotest.(check bool)
+    "ECDHE requires digital signature" true
+    (Ciphersuite.required_usage `ECDHE = `Digital_signature)
+
+(* Test any_ciphersuite_to_ciphersuite13 *)
+let any_to_cs13_valid () =
+  Alcotest.(check bool)
+    "TLS_AES_128_GCM maps" true
+    (Ciphersuite.any_ciphersuite_to_ciphersuite13 Packet.TLS_AES_128_GCM_SHA256
+    = Some `AES_128_GCM_SHA256);
+  Alcotest.(check bool)
+    "TLS_AES_256_GCM maps" true
+    (Ciphersuite.any_ciphersuite_to_ciphersuite13 Packet.TLS_AES_256_GCM_SHA384
+    = Some `AES_256_GCM_SHA384)
+
+let any_to_cs13_invalid () =
+  Alcotest.(check bool)
+    "non-1.3 cipher returns None" true
+    (Ciphersuite.any_ciphersuite_to_ciphersuite13
+       Packet.TLS_RSA_WITH_AES_128_CBC_SHA
+    = None)
+
+let tests =
+  [
+    ("key_length AEAD AES-128-GCM", `Quick, key_length_aead_128_gcm);
+    ("key_length AEAD AES-256-GCM", `Quick, key_length_aead_256_gcm);
+    ("key_length AEAD AES-128-CCM", `Quick, key_length_aead_128_ccm);
+    ("key_length AEAD AES-256-CCM", `Quick, key_length_aead_256_ccm);
+    ("key_length AEAD CHACHA20", `Quick, key_length_aead_chacha20);
+    ("key_length 3DES SHA1", `Quick, key_length_3des_sha1);
+    ("key_length AES-128 SHA256", `Quick, key_length_aes128_sha256);
+    ("key_length AES-256 SHA1", `Quick, key_length_aes256_sha1);
+    ("key_length no iv", `Quick, key_length_no_iv);
+    ("kn_13 AES-128-GCM", `Quick, kn_13_aes_128_gcm);
+    ("kn_13 AES-256-GCM", `Quick, kn_13_aes_256_gcm);
+    ("kn_13 CHACHA20", `Quick, kn_13_chacha20);
+    ("kn_13 AES-128-CCM", `Quick, kn_13_aes_128_ccm);
+    ("kn_13 AES-256-CCM", `Quick, kn_13_aes_256_ccm);
+    ("hash13 AES-128-GCM", `Quick, hash13_aes_128_gcm_sha256);
+    ("hash13 AES-256-GCM", `Quick, hash13_aes_256_gcm_sha384);
+    ("hash13 CHACHA20", `Quick, hash13_chacha20_sha256);
+    ("hash13 AES-128-CCM", `Quick, hash13_aes_128_ccm_sha256);
+    ("privprot13 mapping", `Quick, privprot13_mapping);
+    ("ciphersuite roundtrip", `Quick, ciphersuite_roundtrip);
+    ("kex RSA", `Quick, kex_rsa);
+    ("kex DHE", `Quick, kex_dhe);
+    ("kex ECDHE", `Quick, kex_ecdhe);
+    ("kex ECDHE-ECDSA", `Quick, kex_ecdhe_ecdsa);
+    ("FS true", `Quick, ciphersuite_fs_true);
+    ("FS false", `Quick, ciphersuite_fs_false);
+    ("TLS 1.2 only true", `Quick, ciphersuite_tls12_only_true);
+    ("TLS 1.2 only false", `Quick, ciphersuite_tls12_only_false);
+    ("TLS 1.3 true", `Quick, ciphersuite_tls13_true);
+    ("TLS 1.3 false", `Quick, ciphersuite_tls13_false);
+    ("required_usage RSA", `Quick, required_usage_rsa);
+    ("required_usage DHE", `Quick, required_usage_dhe);
+    ("any_to_cs13 valid", `Quick, any_to_cs13_valid);
+    ("any_to_cs13 invalid", `Quick, any_to_cs13_invalid);
+  ]
+
+let suite = ("ciphersuite", tests)

test/test_handshake_client.ml

···
-let () = ()
-let suite = ("handshake_client", [])
+open Tls
+
+(* Test default_client_hello generation *)
+
+let null_auth ?ip:_ ~host:_ _certs = Ok None
+
+let make_client_config ?(version = (`TLS_1_2, `TLS_1_2))
+    ?(ciphers = Config.Ciphers.supported) ?alpn_protocols () =
+  match
+    Config.client ~authenticator:null_auth ~version ?ciphers:(Some ciphers)
+      ?alpn_protocols ()
+  with
+  | Ok c -> Config.of_client c
+  | Error (`Msg m) -> Alcotest.failf "config error: %s" m
+
+(* Test that default_client_hello produces a valid client hello *)
+let default_ch_has_random () =
+  let config = make_client_config () in
+  let ch, _ver, _secrets = Handshake_client.default_client_hello config in
+  Alcotest.(check int)
+    "random is 32 bytes" 32
+    (String.length ch.Core.client_random)
+
+let default_ch_version () =
+  let config = make_client_config ~version:(`TLS_1_2, `TLS_1_2) () in
+  let ch, ver, _secrets = Handshake_client.default_client_hello config in
+  Alcotest.(check bool) "version is TLS 1.2" true (ver = `TLS_1_2);
+  Alcotest.(check bool)
+    "client_version is TLS 1.2" true
+    (ch.Core.client_version = (`TLS_1_2 :> Core.tls_any_version))
+
+let default_ch_has_ciphersuites () =
+  let config = make_client_config () in
+  let ch, _ver, _secrets = Handshake_client.default_client_hello config in
+  Alcotest.(check bool)
+    "has ciphersuites" true
+    (List.length ch.Core.ciphersuites > 0)
+
+let default_ch_ciphersuites_match_config () =
+  let ciphers =
+    [
+      `RSA_WITH_AES_128_CBC_SHA;
+      `RSA_WITH_AES_256_CBC_SHA;
+      `DHE_RSA_WITH_AES_128_CBC_SHA;
+    ]
+  in
+  let config = make_client_config ~ciphers () in
+  let ch, _ver, _secrets = Handshake_client.default_client_hello config in
+  let expected = List.map Ciphersuite.ciphersuite_to_any_ciphersuite ciphers in
+  (* The CH ciphersuites should contain all configured ones *)
+  List.iter
+    (fun cs ->
+      Alcotest.(check bool)
+        "cipher present" true
+        (List.mem cs ch.Core.ciphersuites))
+    expected
+
+(* Test that ExtendedMasterSecret is always included *)
+let default_ch_has_extended_ms () =
+  let config = make_client_config () in
+  let ch, _ver, _secrets = Handshake_client.default_client_hello config in
+  let has_ems =
+    List.exists
+      (function `ExtendedMasterSecret -> true | _ -> false)
+      ch.Core.extensions
+  in
+  Alcotest.(check bool) "has ExtendedMasterSecret" true has_ems
+
+(* Test TLS 1.2 includes signature algorithms *)
+let default_ch_tls12_has_sig_algs () =
+  let config = make_client_config ~version:(`TLS_1_2, `TLS_1_2) () in
+  let ch, _ver, _secrets = Handshake_client.default_client_hello config in
+  let has_sigalgs =
+    List.exists
+      (function `SignatureAlgorithms _ -> true | _ -> false)
+      ch.Core.extensions
+  in
+  Alcotest.(check bool) "has SignatureAlgorithms" true has_sigalgs
+
+(* Test TLS 1.0 does not include signature algorithms *)
+let default_ch_tls10_no_sig_algs () =
+  let ciphers = [ `RSA_WITH_AES_128_CBC_SHA; `RSA_WITH_3DES_EDE_CBC_SHA ] in
+  let config = make_client_config ~version:(`TLS_1_0, `TLS_1_0) ~ciphers () in
+  let ch, _ver, _secrets = Handshake_client.default_client_hello config in
+  let has_sigalgs =
+    List.exists
+      (function `SignatureAlgorithms _ -> true | _ -> false)
+      ch.Core.extensions
+  in
+  Alcotest.(check bool) "no SignatureAlgorithms for TLS 1.0" false has_sigalgs
+
+(* Test ALPN extension *)
+let default_ch_alpn () =
+  let config = make_client_config ~alpn_protocols:[ "h2"; "http/1.1" ] () in
+  let ch, _ver, _secrets = Handshake_client.default_client_hello config in
+  let alpn =
+    Utils.map_find
+      ~f:(function `ALPN ps -> Some ps | _ -> None)
+      ch.Core.extensions
+  in
+  match alpn with
+  | Some ps ->
+      Alcotest.(check (list string)) "ALPN protocols" [ "h2"; "http/1.1" ] ps
+  | None -> Alcotest.fail "expected ALPN extension"
+
+(* Test TLS 1.3 client hello includes required extensions *)
+let default_ch_tls13_extensions () =
+  let config = make_client_config ~version:(`TLS_1_2, `TLS_1_3) () in
+  let ch, ver, secrets = Handshake_client.default_client_hello config in
+  Alcotest.(check bool) "version is TLS 1.3" true (ver = `TLS_1_3);
+  (* Must have KeyShare *)
+  let has_keyshare =
+    List.exists (function `KeyShare _ -> true | _ -> false) ch.Core.extensions
+  in
+  Alcotest.(check bool) "has KeyShare" true has_keyshare;
+  (* Must have SupportedVersions *)
+  let has_sv =
+    List.exists
+      (function `SupportedVersions _ -> true | _ -> false)
+      ch.Core.extensions
+  in
+  Alcotest.(check bool) "has SupportedVersions" true has_sv;
+  (* Must have SupportedGroups *)
+  let has_groups =
+    List.exists
+      (function `SupportedGroups _ -> true | _ -> false)
+      ch.Core.extensions
+  in
+  Alcotest.(check bool) "has SupportedGroups" true has_groups;
+  (* Must have SignatureAlgorithms *)
+  let has_sigalgs =
+    List.exists
+      (function `SignatureAlgorithms _ -> true | _ -> false)
+      ch.Core.extensions
+  in
+  Alcotest.(check bool) "has SignatureAlgorithms" true has_sigalgs;
+  (* Secrets should be non-empty for TLS 1.3 *)
+  Alcotest.(check bool) "has secrets" true (List.length secrets > 0)
+
+(* Test that each client random is unique (non-deterministic) *)
+let default_ch_unique_randoms () =
+  let config = make_client_config () in
+  let ch1, _, _ = Handshake_client.default_client_hello config in
+  let ch2, _, _ = Handshake_client.default_client_hello config in
+  Alcotest.(check bool)
+    "different randoms" false
+    (String.equal ch1.Core.client_random ch2.Core.client_random)
+
+let tests =
+  [
+    ("CH has 32-byte random", `Quick, default_ch_has_random);
+    ("CH version matches config", `Quick, default_ch_version);
+    ("CH has ciphersuites", `Quick, default_ch_has_ciphersuites);
+    ( "CH ciphersuites match config",
+      `Quick,
+      default_ch_ciphersuites_match_config );
+    ("CH has ExtendedMasterSecret", `Quick, default_ch_has_extended_ms);
+    ("CH TLS 1.2 has sig algs", `Quick, default_ch_tls12_has_sig_algs);
+    ("CH TLS 1.0 no sig algs", `Quick, default_ch_tls10_no_sig_algs);
+    ("CH ALPN", `Quick, default_ch_alpn);
+    ("CH TLS 1.3 extensions", `Quick, default_ch_tls13_extensions);
+    ("CH unique randoms", `Quick, default_ch_unique_randoms);
+  ]
+
+let suite = ("handshake_client", tests)

test/test_handshake_client13.ml

···
-let () = ()
-let suite = ("handshake_client13", [])
+open Tls
+
+(* Tests for TLS 1.3 client handshake.
+
+   The Handshake_client13 module is largely stateful and processes
+   complete handshake messages. We test the observable properties
+   of TLS 1.3 client hello construction and key share generation. *)
+
+let null_auth ?ip:_ ~host:_ _certs = Ok None
+
+let make_tls13_config ?(groups = Config.supported_groups) ?alpn_protocols () =
+  match
+    Config.client ~authenticator:null_auth ~version:(`TLS_1_2, `TLS_1_3) ~groups
+      ?alpn_protocols ()
+  with
+  | Ok c -> Config.of_client c
+  | Error (`Msg m) -> Alcotest.failf "config error: %s" m
+
+let get_client_extensions (ch : Core.client_hello) = ch.extensions
+
+(* Test TLS 1.3 client hello has key shares *)
+let ch13_has_keyshares () =
+  let config = make_tls13_config () in
+  let ch, ver, secrets = Handshake_client.default_client_hello config in
+  Alcotest.(check bool) "version 1.3" true (ver = `TLS_1_3);
+  let exts = get_client_extensions ch in
+  let keyshares =
+    Utils.map_find ~f:(function `KeyShare ks -> Some ks | _ -> None) exts
+  in
+  match keyshares with
+  | Some ks ->
+      Alcotest.(check bool) "has keyshares" true (List.length ks > 0);
+      (* Each keyshare should have a corresponding secret *)
+      Alcotest.(check bool)
+        "secrets match keyshares" true
+        (List.length secrets >= List.length ks)
+  | None -> Alcotest.fail "expected KeyShare extension"
+
+(* Test key share groups are from supported groups *)
+let ch13_keyshare_groups_valid () =
+  let groups = [ `X25519; `P256 ] in
+  let config = make_tls13_config ~groups () in
+  let ch, _ver, _secrets = Handshake_client.default_client_hello config in
+  let exts = get_client_extensions ch in
+  let keyshares =
+    Utils.map_find ~f:(function `KeyShare ks -> Some ks | _ -> None) exts
+  in
+  match keyshares with
+  | Some ks ->
+      let named_groups = List.map fst ks in
+      let valid_groups = List.map Core.group_to_named_group groups in
+      List.iter
+        (fun ng ->
+          Alcotest.(check bool)
+            "keyshare group in config" true (List.mem ng valid_groups))
+        named_groups
+  | None -> Alcotest.fail "expected KeyShare extension"
+
+(* Test supported versions extension includes TLS 1.3 *)
+let ch13_supported_versions () =
+  let config = make_tls13_config () in
+  let ch, _ver, _secrets = Handshake_client.default_client_hello config in
+  let exts = get_client_extensions ch in
+  let sv =
+    Utils.map_find
+      ~f:(function `SupportedVersions vs -> Some vs | _ -> None)
+      exts
+  in
+  match sv with
+  | Some vs ->
+      let has_13 = List.exists (function `TLS_1_3 -> true | _ -> false) vs in
+      Alcotest.(check bool) "includes TLS 1.3" true has_13
+  | None -> Alcotest.fail "expected SupportedVersions extension"
+
+(* Test supported groups extension *)
+let ch13_supported_groups () =
+  let groups = [ `X25519; `P384 ] in
+  let config = make_tls13_config ~groups () in
+  let ch, _ver, _secrets = Handshake_client.default_client_hello config in
+  let exts = get_client_extensions ch in
+  let sg =
+    Utils.map_find
+      ~f:(function `SupportedGroups gs -> Some gs | _ -> None)
+      exts
+  in
+  match sg with
+  | Some gs ->
+      let expected = List.map Core.group_to_named_group groups in
+      List.iter
+        (fun g -> Alcotest.(check bool) "group present" true (List.mem g gs))
+        expected
+  | None -> Alcotest.fail "expected SupportedGroups extension"
+
+(* Test key shares have non-empty public keys *)
+let ch13_keyshare_nonempty () =
+  let config = make_tls13_config () in
+  let ch, _ver, _secrets = Handshake_client.default_client_hello config in
+  let exts = get_client_extensions ch in
+  let keyshares =
+    Utils.map_find ~f:(function `KeyShare ks -> Some ks | _ -> None) exts
+  in
+  match keyshares with
+  | Some ks ->
+      List.iter
+        (fun (_g, share) ->
+          Alcotest.(check bool) "share not empty" true (String.length share > 0))
+        ks
+  | None -> Alcotest.fail "expected KeyShare extension"
+
+(* Test ALPN is forwarded in TLS 1.3 client hello *)
+let ch13_alpn () =
+  let config = make_tls13_config ~alpn_protocols:[ "h2"; "http/1.1" ] () in
+  let ch, _ver, _secrets = Handshake_client.default_client_hello config in
+  let exts = get_client_extensions ch in
+  let alpn =
+    Utils.map_find ~f:(function `ALPN ps -> Some ps | _ -> None) exts
+  in
+  match alpn with
+  | Some ps ->
+      Alcotest.(check (list string)) "ALPN protocols" [ "h2"; "http/1.1" ] ps
+  | None -> Alcotest.fail "expected ALPN extension"
+
+(* Test that TLS 1.3 ciphersuites are included *)
+let ch13_has_tls13_ciphers () =
+  let config = make_tls13_config () in
+  let ch, _ver, _secrets = Handshake_client.default_client_hello config in
+  let has_13_cipher =
+    List.exists
+      (fun cs -> Ciphersuite.any_ciphersuite_to_ciphersuite13 cs <> None)
+      ch.ciphersuites
+  in
+  Alcotest.(check bool) "has TLS 1.3 cipher" true has_13_cipher
+
+(* Test different key share generations produce different public keys *)
+let ch13_unique_keyshares () =
+  let config = make_tls13_config () in
+  let ch1, _, _ = Handshake_client.default_client_hello config in
+  let ch2, _, _ = Handshake_client.default_client_hello config in
+  let get_ks (ch : Core.client_hello) =
+    Utils.map_find
+      ~f:(function `KeyShare ks -> Some ks | _ -> None)
+      ch.extensions
+  in
+  match (get_ks ch1, get_ks ch2) with
+  | Some ks1, Some ks2 ->
+      (* At least first key share should differ *)
+      let s1 = snd (List.hd ks1) in
+      let s2 = snd (List.hd ks2) in
+      Alcotest.(check bool) "different key shares" false (String.equal s1 s2)
+  | _ -> Alcotest.fail "expected key shares"
+
+(* Test key shares are a subset of supported groups (RFC 8446 4.2.8) *)
+let ch13_keyshares_subset_of_groups () =
+  let config = make_tls13_config () in
+  let ch, _ver, _secrets = Handshake_client.default_client_hello config in
+  let exts = get_client_extensions ch in
+  let keyshares =
+    Utils.map_find ~f:(function `KeyShare ks -> Some ks | _ -> None) exts
+  in
+  let groups =
+    Utils.map_find
+      ~f:(function `SupportedGroups gs -> Some gs | _ -> None)
+      exts
+  in
+  match (keyshares, groups) with
+  | Some ks, Some gs ->
+      List.iter
+        (fun (g, _) ->
+          Alcotest.(check bool)
+            "keyshare group in supported groups" true (List.mem g gs))
+        ks
+  | _ -> Alcotest.fail "expected both extensions"
+
+let tests =
+  [
+    ("CH13 has keyshares", `Quick, ch13_has_keyshares);
+    ("CH13 keyshare groups valid", `Quick, ch13_keyshare_groups_valid);
+    ("CH13 supported versions", `Quick, ch13_supported_versions);
+    ("CH13 supported groups", `Quick, ch13_supported_groups);
+    ("CH13 keyshare nonempty", `Quick, ch13_keyshare_nonempty);
+    ("CH13 ALPN", `Quick, ch13_alpn);
+    ("CH13 has TLS 1.3 ciphers", `Quick, ch13_has_tls13_ciphers);
+    ("CH13 unique keyshares", `Quick, ch13_unique_keyshares);
+    ("CH13 keyshares subset of groups", `Quick, ch13_keyshares_subset_of_groups);
+  ]
+
+let suite = ("handshake_client13", tests)

test/test_handshake_common.ml

···
-let () = ()
-let suite = ("handshake_common", [])
+open Tls
+
+(* Test supported_protocol_version *)
+let supported_version_in_range () =
+  let range = (`TLS_1_0, `TLS_1_2) in
+  Alcotest.(check bool)
+    "1.0 in range" true
+    (Handshake_common.supported_protocol_version range `TLS_1_0 = Some `TLS_1_0);
+  Alcotest.(check bool)
+    "1.1 in range" true
+    (Handshake_common.supported_protocol_version range `TLS_1_1 = Some `TLS_1_1);
+  Alcotest.(check bool)
+    "1.2 in range" true
+    (Handshake_common.supported_protocol_version range `TLS_1_2 = Some `TLS_1_2)
+
+let supported_version_below_range () =
+  let range = (`TLS_1_2, `TLS_1_3) in
+  Alcotest.(check bool)
+    "1.0 below range" true
+    (Handshake_common.supported_protocol_version range `TLS_1_0 = None);
+  Alcotest.(check bool)
+    "1.1 below range" true
+    (Handshake_common.supported_protocol_version range `TLS_1_1 = None)
+
+let supported_version_above_range () =
+  let range = (`TLS_1_0, `TLS_1_1) in
+  Alcotest.(check bool)
+    "1.2 above range" true
+    (Handshake_common.supported_protocol_version range `TLS_1_2 = None);
+  Alcotest.(check bool)
+    "1.3 above range" true
+    (Handshake_common.supported_protocol_version range `TLS_1_3 = None)
+
+let supported_version_exact () =
+  let range = (`TLS_1_2, `TLS_1_2) in
+  Alcotest.(check bool)
+    "exact match" true
+    (Handshake_common.supported_protocol_version range `TLS_1_2 = Some `TLS_1_2);
+  Alcotest.(check bool)
+    "below exact" true
+    (Handshake_common.supported_protocol_version range `TLS_1_1 = None);
+  Alcotest.(check bool)
+    "above exact" true
+    (Handshake_common.supported_protocol_version range `TLS_1_3 = None)
+
+(* Test server_exts_subset_of_client *)
+let server_exts_empty_always_subset () =
+  let cexts : Core.client_extension list = [ `ExtendedMasterSecret ] in
+  Alcotest.(check bool)
+    "empty server exts" true
+    (Handshake_common.server_exts_subset_of_client [] cexts)
+
+let server_exts_subset () =
+  let cexts : Core.client_extension list =
+    [ `ExtendedMasterSecret; `SecureRenegotiation "" ]
+  in
+  let sexts : Core.server_extension list = [ `ExtendedMasterSecret ] in
+  Alcotest.(check bool)
+    "server subset of client" true
+    (Handshake_common.server_exts_subset_of_client sexts cexts)
+
+let server_exts_not_subset () =
+  let cexts : Core.client_extension list = [ `ExtendedMasterSecret ] in
+  let sexts : Core.server_extension list = [ `ALPN "h2" ] in
+  Alcotest.(check bool)
+    "server not subset" false
+    (Handshake_common.server_exts_subset_of_client sexts cexts)
+
+(* Test server_hello_valid *)
+let server_hello_valid_no_dups () =
+  let sh : Core.server_hello =
+    {
+      server_version = `TLS_1_2;
+      server_random = String.make 32 '\x00';
+      sessionid = None;
+      ciphersuite = `RSA_WITH_AES_128_CBC_SHA;
+      extensions = [ `Hostname; `ExtendedMasterSecret ];
+    }
+  in
+  Alcotest.(check bool) "valid SH" true (Handshake_common.server_hello_valid sh)
+
+let server_hello_valid_dup_exts () =
+  let sh : Core.server_hello =
+    {
+      server_version = `TLS_1_2;
+      server_random = String.make 32 '\x00';
+      sessionid = None;
+      ciphersuite = `RSA_WITH_AES_128_CBC_SHA;
+      extensions = [ `Hostname; `Hostname ];
+    }
+  in
+  Alcotest.(check bool)
+    "invalid SH (dup exts)" false
+    (Handshake_common.server_hello_valid sh)
+
+(* Test hostname extraction *)
+let hostname_present () =
+  let host = Domain_name.of_string_exn "example.com" |> Domain_name.host_exn in
+  let ch : Core.client_hello =
+    {
+      client_version = `TLS_1_2;
+      client_random = String.make 32 '\x00';
+      sessionid = None;
+      ciphersuites = [];
+      extensions = [ `Hostname host ];
+    }
+  in
+  match Handshake_common.hostname ch with
+  | Some h ->
+      Alcotest.(check string) "hostname" "example.com" (Domain_name.to_string h)
+  | None -> Alcotest.fail "expected hostname"
+
+let hostname_absent () =
+  let ch : Core.client_hello =
+    {
+      client_version = `TLS_1_2;
+      client_random = String.make 32 '\x00';
+      sessionid = None;
+      ciphersuites = [];
+      extensions = [];
+    }
+  in
+  Alcotest.(check bool) "no hostname" true (Handshake_common.hostname ch = None)
+
+(* Test get_secure_renegotiation *)
+let secure_reneg_present () =
+  let exts : Core.server_extension list =
+    [ `Hostname; `SecureRenegotiation "data" ]
+  in
+  match Handshake_common.get_secure_renegotiation exts with
+  | Some d -> Alcotest.(check string) "reneg data" "data" d
+  | None -> Alcotest.fail "expected reneg data"
+
+let secure_reneg_absent () =
+  let exts : Core.server_extension list = [ `Hostname ] in
+  Alcotest.(check bool)
+    "no reneg" true
+    (Handshake_common.get_secure_renegotiation exts = None)
+
+(* Test get_alpn_protocols *)
+let alpn_present () =
+  let ch : Core.client_hello =
+    {
+      client_version = `TLS_1_2;
+      client_random = String.make 32 '\x00';
+      sessionid = None;
+      ciphersuites = [];
+      extensions = [ `ALPN [ "h2"; "http/1.1" ] ];
+    }
+  in
+  match Handshake_common.get_alpn_protocols ch with
+  | Some ps -> Alcotest.(check (list string)) "alpn" [ "h2"; "http/1.1" ] ps
+  | None -> Alcotest.fail "expected alpn"
+
+let alpn_absent () =
+  let ch : Core.client_hello =
+    {
+      client_version = `TLS_1_2;
+      client_random = String.make 32 '\x00';
+      sessionid = None;
+      ciphersuites = [];
+      extensions = [];
+    }
+  in
+  Alcotest.(check bool)
+    "no alpn" true
+    (Handshake_common.get_alpn_protocols ch = None)
+
+(* Test to_sign_1_3 *)
+let to_sign_1_3_no_context () =
+  let result = Handshake_common.to_sign_1_3 None in
+  (* 64 spaces + 1 null byte *)
+  Alcotest.(check int) "length" 65 (String.length result);
+  (* first 64 bytes are 0x20 *)
+  for i = 0 to 63 do
+    Alcotest.(check int) "space" 0x20 (Char.code (String.get result i))
+  done;
+  (* last byte is 0x00 *)
+  Alcotest.(check int) "null" 0x00 (Char.code (String.get result 64))
+
+let to_sign_1_3_with_context () =
+  let ctx = "TLS 1.3, server CertificateVerify" in
+  let result = Handshake_common.to_sign_1_3 (Some ctx) in
+  (* 64 spaces + context string + 1 null byte *)
+  Alcotest.(check int)
+    "length"
+    (64 + String.length ctx + 1)
+    (String.length result);
+  (* first 64 bytes are spaces *)
+  for i = 0 to 63 do
+    Alcotest.(check int) "space" 0x20 (Char.code (String.get result i))
+  done;
+  (* context string follows *)
+  Alcotest.(check string)
+    "context" ctx
+    (String.sub result 64 (String.length ctx));
+  (* last byte is null *)
+  Alcotest.(check int)
+    "null" 0x00
+    (Char.code (String.get result (String.length result - 1)))
+
+let tests =
+  [
+    ("supported_version in range", `Quick, supported_version_in_range);
+    ("supported_version below range", `Quick, supported_version_below_range);
+    ("supported_version above range", `Quick, supported_version_above_range);
+    ("supported_version exact", `Quick, supported_version_exact);
+    ("server_exts empty always subset", `Quick, server_exts_empty_always_subset);
+    ("server_exts subset", `Quick, server_exts_subset);
+    ("server_exts not subset", `Quick, server_exts_not_subset);
+    ("server_hello_valid no dups", `Quick, server_hello_valid_no_dups);
+    ("server_hello_valid dup exts", `Quick, server_hello_valid_dup_exts);
+    ("hostname present", `Quick, hostname_present);
+    ("hostname absent", `Quick, hostname_absent);
+    ("secure reneg present", `Quick, secure_reneg_present);
+    ("secure reneg absent", `Quick, secure_reneg_absent);
+    ("alpn present", `Quick, alpn_present);
+    ("alpn absent", `Quick, alpn_absent);
+    ("to_sign_1_3 no context", `Quick, to_sign_1_3_no_context);
+    ("to_sign_1_3 with context", `Quick, to_sign_1_3_with_context);
+  ]
+
+let suite = ("handshake_common", tests)

test/test_handshake_crypto.ml

···
-let () = ()
-let suite = ("handshake_crypto", [])
+open Tls
+
+let cs =
+  let module M = struct
+    type t = string
+
+    let pp = Ohex.pp_hexdump ()
+    let equal = String.equal
+  end in
+  (module M : Alcotest.TESTABLE with type t = M.t)
+
+(* RFC 5246 Section 5 defines the TLS PRF for TLS 1.2:
+   PRF(secret, label, seed) = P_<hash>(secret, label + seed)
+   where P_hash uses HMAC with the cipher suite's hash.
+
+   We test against known good values by verifying properties and
+   consistency of the PRF implementation. *)
+
+(* Test PRF output length: PRF should produce exactly the requested number of bytes *)
+let prf_output_length () =
+  let secret = String.make 48 '\xab' in
+  let seed = String.make 32 '\xcd' in
+  List.iter
+    (fun len ->
+      let result =
+        Handshake_crypto.pseudo_random_function `TLS_1_2
+          `RSA_WITH_AES_128_GCM_SHA256 len secret "test label" seed
+      in
+      Alcotest.(check int)
+        (Printf.sprintf "PRF length %d" len)
+        len (String.length result))
+    [ 0; 1; 12; 16; 32; 48; 64; 128; 256 ]
+
+(* Test PRF determinism: same inputs must produce same output *)
+let prf_deterministic () =
+  let secret = String.make 48 '\x01' in
+  let seed = String.make 32 '\x02' in
+  let r1 =
+    Handshake_crypto.pseudo_random_function `TLS_1_2
+      `RSA_WITH_AES_128_GCM_SHA256 32 secret "master secret" seed
+  in
+  let r2 =
+    Handshake_crypto.pseudo_random_function `TLS_1_2
+      `RSA_WITH_AES_128_GCM_SHA256 32 secret "master secret" seed
+  in
+  Alcotest.check cs "deterministic" r1 r2
+
+(* Test that different labels produce different output *)
+let prf_different_labels () =
+  let secret = String.make 48 '\x01' in
+  let seed = String.make 32 '\x02' in
+  let r1 =
+    Handshake_crypto.pseudo_random_function `TLS_1_2
+      `RSA_WITH_AES_128_GCM_SHA256 32 secret "client finished" seed
+  in
+  let r2 =
+    Handshake_crypto.pseudo_random_function `TLS_1_2
+      `RSA_WITH_AES_128_GCM_SHA256 32 secret "server finished" seed
+  in
+  Alcotest.(check bool) "different labels differ" false (String.equal r1 r2)
+
+(* Test that different seeds produce different output *)
+let prf_different_seeds () =
+  let secret = String.make 48 '\x01' in
+  let seed1 = String.make 32 '\x02' in
+  let seed2 = String.make 32 '\x03' in
+  let r1 =
+    Handshake_crypto.pseudo_random_function `TLS_1_2
+      `RSA_WITH_AES_128_GCM_SHA256 32 secret "test" seed1
+  in
+  let r2 =
+    Handshake_crypto.pseudo_random_function `TLS_1_2
+      `RSA_WITH_AES_128_GCM_SHA256 32 secret "test" seed2
+  in
+  Alcotest.(check bool) "different seeds differ" false (String.equal r1 r2)
+
+(* Test PRF prefix property: PRF(n) should be a prefix of PRF(n+k) *)
+let prf_prefix_property () =
+  let secret = String.make 48 '\xab' in
+  let seed = String.make 32 '\xcd' in
+  let short =
+    Handshake_crypto.pseudo_random_function `TLS_1_2
+      `RSA_WITH_AES_128_GCM_SHA256 32 secret "test" seed
+  in
+  let long =
+    Handshake_crypto.pseudo_random_function `TLS_1_2
+      `RSA_WITH_AES_128_GCM_SHA256 64 secret "test" seed
+  in
+  Alcotest.check cs "prefix" short (String.sub long 0 32)
+
+(* Test TLS 1.0/1.1 PRF uses MD5+SHA1 split (RFC 2246 Section 5) *)
+let prf_tls10_deterministic () =
+  let secret = String.make 48 '\x01' in
+  let seed = String.make 32 '\x02' in
+  let r1 =
+    Handshake_crypto.pseudo_random_function `TLS_1_0 `RSA_WITH_AES_128_CBC_SHA
+      32 secret "master secret" seed
+  in
+  let r2 =
+    Handshake_crypto.pseudo_random_function `TLS_1_0 `RSA_WITH_AES_128_CBC_SHA
+      32 secret "master secret" seed
+  in
+  Alcotest.check cs "TLS 1.0 deterministic" r1 r2
+
+let prf_tls10_prefix () =
+  let secret = String.make 48 '\x01' in
+  let seed = String.make 32 '\x02' in
+  let short =
+    Handshake_crypto.pseudo_random_function `TLS_1_0 `RSA_WITH_AES_128_CBC_SHA
+      16 secret "test" seed
+  in
+  let long =
+    Handshake_crypto.pseudo_random_function `TLS_1_0 `RSA_WITH_AES_128_CBC_SHA
+      64 secret "test" seed
+  in
+  Alcotest.check cs "TLS 1.0 prefix" short (String.sub long 0 16)
+
+(* Test TLS 1.0 vs 1.2 PRF produce different results (different algorithms) *)
+let prf_version_difference () =
+  let secret = String.make 48 '\x01' in
+  let seed = String.make 32 '\x02' in
+  let r10 =
+    Handshake_crypto.pseudo_random_function `TLS_1_0 `RSA_WITH_AES_128_CBC_SHA
+      32 secret "test" seed
+  in
+  let r12 =
+    Handshake_crypto.pseudo_random_function `TLS_1_2 `RSA_WITH_AES_128_CBC_SHA
+      32 secret "test" seed
+  in
+  Alcotest.(check bool) "different versions differ" false (String.equal r10 r12)
+
+(* Test TLS 1.2 PRF with SHA384 cipher suite *)
+let prf_sha384_cipher () =
+  let secret = String.make 48 '\xab' in
+  let seed = String.make 32 '\xcd' in
+  let r256 =
+    Handshake_crypto.pseudo_random_function `TLS_1_2
+      `RSA_WITH_AES_128_GCM_SHA256 32 secret "test" seed
+  in
+  let r384 =
+    Handshake_crypto.pseudo_random_function `TLS_1_2
+      `RSA_WITH_AES_256_GCM_SHA384 32 secret "test" seed
+  in
+  (* SHA256 and SHA384 based PRFs should differ *)
+  Alcotest.(check bool) "SHA256 vs SHA384 differ" false (String.equal r256 r384)
+
+(* Test finished computation: 12 bytes output per RFC 5246 Section 7.4.9 *)
+let finished_output_length () =
+  let master = String.make 48 '\x01' in
+  let result =
+    Handshake_crypto.finished `TLS_1_2 `RSA_WITH_AES_128_GCM_SHA256 master
+      "client finished" [ "hello"; "world" ]
+  in
+  Alcotest.(check int) "finished is 12 bytes" 12 (String.length result)
+
+(* Test finished: client and server differ *)
+let finished_client_server_differ () =
+  let master = String.make 48 '\x01' in
+  let log = [ "handshake_msg_1"; "handshake_msg_2" ] in
+  let client =
+    Handshake_crypto.finished `TLS_1_2 `RSA_WITH_AES_128_GCM_SHA256 master
+      "client finished" log
+  in
+  let server =
+    Handshake_crypto.finished `TLS_1_2 `RSA_WITH_AES_128_GCM_SHA256 master
+      "server finished" log
+  in
+  Alcotest.(check bool) "client != server" false (String.equal client server)
+
+(* Test finished: deterministic *)
+let finished_deterministic () =
+  let master = String.make 48 '\x01' in
+  let log = [ "msg" ] in
+  let r1 =
+    Handshake_crypto.finished `TLS_1_2 `RSA_WITH_AES_128_GCM_SHA256 master
+      "client finished" log
+  in
+  let r2 =
+    Handshake_crypto.finished `TLS_1_2 `RSA_WITH_AES_128_GCM_SHA256 master
+      "client finished" log
+  in
+  Alcotest.check cs "deterministic finished" r1 r2
+
+(* Test finished uses the correct internal hash:
+   For TLS 1.0, the hash is MD5+SHA1 (36 bytes);
+   for TLS 1.2 with SHA256 cipher, 32 bytes.
+   We verify this indirectly via finished output. *)
+let finished_tls10_output () =
+  let master = String.make 48 '\xab' in
+  let log = [ "msg1"; "msg2" ] in
+  let result =
+    Handshake_crypto.finished `TLS_1_0 `RSA_WITH_AES_128_CBC_SHA master
+      "client finished" log
+  in
+  Alcotest.(check int) "TLS 1.0 finished is 12 bytes" 12 (String.length result)
+
+let finished_tls10_vs_tls12 () =
+  let master = String.make 48 '\xab' in
+  let log = [ "msg" ] in
+  let r10 =
+    Handshake_crypto.finished `TLS_1_0 `RSA_WITH_AES_128_CBC_SHA master
+      "client finished" log
+  in
+  let r12 =
+    Handshake_crypto.finished `TLS_1_2 `RSA_WITH_AES_128_CBC_SHA master
+      "client finished" log
+  in
+  (* Different PRF algorithms should produce different finished values *)
+  Alcotest.(check bool) "TLS 1.0 vs 1.2 differ" false (String.equal r10 r12)
+
+(* Verify PRF against a manually computed HMAC-SHA256 based P_hash.
+   For TLS 1.2 with AES_128_GCM_SHA256, PRF uses HMAC-SHA256.
+   P_SHA256(secret, seed) = HMAC_SHA256(secret, A(1) + seed)
+   where A(1) = HMAC_SHA256(secret, seed) *)
+let prf_tls12_manual_verification () =
+  let secret = "secret_key_for_prf_test_padding!" in
+  (* 32 bytes *)
+  let label = "test label" in
+  let seed = "seed_data_for_testing_prf_func!" in
+  (* 31 bytes *)
+  let labelled_seed = label ^ seed in
+  (* Compute manually: A(1) = HMAC-SHA256(secret, label+seed) *)
+  let a1 =
+    Digestif.SHA256.(to_raw_string (hmac_string ~key:secret labelled_seed))
+  in
+  (* P_SHA256 first block = HMAC-SHA256(secret, A(1) + label+seed) *)
+  let p1 =
+    Digestif.SHA256.(
+      to_raw_string (hmac_string ~key:secret (a1 ^ labelled_seed)))
+  in
+  (* PRF output for 32 bytes should equal first 32 bytes of P_SHA256 *)
+  let prf_result =
+    Handshake_crypto.pseudo_random_function `TLS_1_2
+      `RSA_WITH_AES_128_GCM_SHA256 32 secret label seed
+  in
+  Alcotest.check cs "PRF matches manual HMAC-SHA256" (String.sub p1 0 32)
+    prf_result
+
+let tests =
+  [
+    ("PRF output length", `Quick, prf_output_length);
+    ("PRF deterministic", `Quick, prf_deterministic);
+    ("PRF different labels", `Quick, prf_different_labels);
+    ("PRF different seeds", `Quick, prf_different_seeds);
+    ("PRF prefix property", `Quick, prf_prefix_property);
+    ("PRF TLS 1.0 deterministic", `Quick, prf_tls10_deterministic);
+    ("PRF TLS 1.0 prefix", `Quick, prf_tls10_prefix);
+    ("PRF version difference", `Quick, prf_version_difference);
+    ("PRF SHA384 cipher", `Quick, prf_sha384_cipher);
+    ("finished output length", `Quick, finished_output_length);
+    ("finished client/server differ", `Quick, finished_client_server_differ);
+    ("finished deterministic", `Quick, finished_deterministic);
+    ("finished TLS 1.0 output", `Quick, finished_tls10_output);
+    ("finished TLS 1.0 vs 1.2", `Quick, finished_tls10_vs_tls12);
+    ("PRF TLS 1.2 manual verification", `Quick, prf_tls12_manual_verification);
+  ]
+
+let suite = ("handshake_crypto", tests)

test/test_handshake_crypto13.ml

···
-let () = ()
-let suite = ("handshake_crypto13", [])
+open Tls
+
+let cs =
+  let module M = struct
+    type t = string
+
+    let pp = Ohex.pp_hexdump ()
+    let equal = String.equal
+  end in
+  (module M : Alcotest.TESTABLE with type t = M.t)
+
+(* RFC 8446 Appendix A / draft-ietf-tls-tls13-vectors-07 test vectors.
+   These are the same vectors used in test_tls_crypto.ml but we test
+   the individual Handshake_crypto13 functions in isolation. *)
+
+let cipher = `AES_128_GCM_SHA256
+let hash = Ciphersuite.hash13 cipher
+
+(* Test derive_secret_no_hash with known values *)
+
+(* RFC 5869 Appendix A.1: HKDF-Expand test case 1
+   (We test via the TLS 1.3 HKDF-Expand-Label wrapper) *)
+
+(* Test empty cipher creates correct initial state *)
+let empty_state () =
+  let t = Handshake_crypto13.empty cipher in
+  Alcotest.(check int)
+    "empty secret is empty string" 0
+    (String.length t.State.secret);
+  Alcotest.(check bool) "hash is SHA256" true (t.State.hash = `SHA256)
+
+let empty_state_sha384 () =
+  let t = Handshake_crypto13.empty `AES_256_GCM_SHA384 in
+  Alcotest.(check bool) "hash is SHA384" true (t.State.hash = `SHA384)
+
+(* Test derive: first extraction with zero PSK.
+   From RFC 8446 key schedule: Early Secret = HKDF-Extract(0, 0)
+   salt="" (empty), ikm = 0^32 *)
+let derive_early_secret () =
+  let expected =
+    Ohex.decode
+      "33ad0a1c607ec03b09e6cd9893680ce210adf300aa1f2660e1b22e10f170f92a"
+  in
+  let t = Handshake_crypto13.(derive (empty cipher) (String.make 32 '\x00')) in
+  Alcotest.check cs "early secret" expected t.State.secret
+
+(* Test derive_secret_no_hash: derive "derived" from early secret *)
+let derive_derived_from_early () =
+  let early_secret =
+    Ohex.decode
+      "33ad0a1c607ec03b09e6cd9893680ce210adf300aa1f2660e1b22e10f170f92a"
+  in
+  let expected =
+    Ohex.decode
+      "6f2615a108c702c5678f54fc9dbab69716c076189c48250cebeac3576c3611ba"
+  in
+  let module H = (val Digestif.module_of_hash' hash) in
+  let hash_val = H.(to_raw_string (digest_string "")) in
+  let result =
+    Handshake_crypto13.derive_secret_no_hash hash early_secret ~ctx:hash_val
+      "derived"
+  in
+  Alcotest.check cs "derived secret" expected result
+
+(* Test handshake secret extraction *)
+let extract_handshake_secret () =
+  let salt =
+    Ohex.decode
+      "6f2615a108c702c5678f54fc9dbab69716c076189c48250cebeac3576c3611ba"
+  in
+  let ikm =
+    Ohex.decode
+      "8bd4054fb55b9d63fdfbacf9f04b9f0d35e6d63f537563efd46272900f89492d"
+  in
+  let expected =
+    Ohex.decode
+      "1dc826e93606aa6fdc0aadc12f741b01046aa6b99f691ed221a9f0ca043fbeac"
+  in
+  let result = Hkdf.extract ~hash ~salt ikm in
+  Alcotest.check cs "handshake secret" expected result
+
+(* Test traffic_key derivation *)
+let traffic_key_derivation () =
+  let c_hs_traffic =
+    Ohex.decode
+      "b3eddb126e067f35a780b3abf45e2d8f3b1a950738f52e9600746a0e27a55a21"
+  in
+  let expected_key = Ohex.decode "dbfaa693d1762c5b666af5d950258d01" in
+  let expected_iv = Ohex.decode "5bd3c71b836e0b76bb73265f" in
+  let key, iv = Handshake_crypto13.traffic_key cipher c_hs_traffic in
+  Alcotest.check cs "client hs key" expected_key key;
+  Alcotest.check cs "client hs iv" expected_iv iv
+
+let traffic_key_server () =
+  let s_hs_traffic =
+    Ohex.decode
+      "b67b7d690cc16c4e75e54213cb2d37b4e9c912bcded9105d42befd59d391ad38"
+  in
+  let expected_key = Ohex.decode "3fce516009c21727d0f2e4e86ee403bc" in
+  let expected_iv = Ohex.decode "5d313eb2671276ee13000b30" in
+  let key, iv = Handshake_crypto13.traffic_key cipher s_hs_traffic in
+  Alcotest.check cs "server hs key" expected_key key;
+  Alcotest.check cs "server hs iv" expected_iv iv
+
+(* Test derive_secret_no_hash for key and iv expansion *)
+let expand_key_from_traffic_secret () =
+  let c_hs_traffic =
+    Ohex.decode
+      "b3eddb126e067f35a780b3abf45e2d8f3b1a950738f52e9600746a0e27a55a21"
+  in
+  let expected_key = Ohex.decode "dbfaa693d1762c5b666af5d950258d01" in
+  let expected_iv = Ohex.decode "5bd3c71b836e0b76bb73265f" in
+  Alcotest.check cs "key via expand" expected_key
+    (Handshake_crypto13.derive_secret_no_hash hash c_hs_traffic ~length:16 "key");
+  Alcotest.check cs "iv via expand" expected_iv
+    (Handshake_crypto13.derive_secret_no_hash hash c_hs_traffic ~length:12 "iv")
+
+(* Test finished key derivation *)
+let finished_key_derivation () =
+  let s_hs_traffic =
+    Ohex.decode
+      "b67b7d690cc16c4e75e54213cb2d37b4e9c912bcded9105d42befd59d391ad38"
+  in
+  let expected_finished_key =
+    Ohex.decode
+      "008d3b66f816ea559f96b537e885c31fc068bf492c652f01f288a1d8cdc19fc8"
+  in
+  Alcotest.check cs "finished expanded" expected_finished_key
+    (Handshake_crypto13.derive_secret_no_hash hash s_hs_traffic "finished")
+
+(* Test master secret derivation *)
+let derive_master_salt () =
+  let hs_secret =
+    Ohex.decode
+      "1dc826e93606aa6fdc0aadc12f741b01046aa6b99f691ed221a9f0ca043fbeac"
+  in
+  let expected =
+    Ohex.decode
+      "43de77e0c77713859a944db9db2590b53190a65b3ee2e4f12dd7a0bb7ce254b4"
+  in
+  let module H = (val Digestif.module_of_hash' hash) in
+  let hash_val = H.(to_raw_string (digest_string "")) in
+  Alcotest.check cs "master salt" expected
+    (Handshake_crypto13.derive_secret_no_hash hash hs_secret ~ctx:hash_val
+       "derived")
+
+let extract_master_secret () =
+  let salt =
+    Ohex.decode
+      "43de77e0c77713859a944db9db2590b53190a65b3ee2e4f12dd7a0bb7ce254b4"
+  in
+  let expected =
+    Ohex.decode
+      "18df06843d13a08bf2a449844c5f8a478001bc4d4c627984d5a41da8d0402919"
+  in
+  let result = Hkdf.extract ~hash ~salt (String.make 32 '\x00') in
+  Alcotest.check cs "master secret" expected result
+
+(* Test res_secret *)
+let res_secret_derivation () =
+  let res_master =
+    Ohex.decode
+      "7df235f2031d2a051287d02b0241b0bfdaf86cc856231f2d5aba46c434ec196c"
+  in
+  let nonce = String.make 2 '\x00' in
+  let expected =
+    Ohex.decode
+      "4ecd0eb6ec3b4d87f5d6028f922ca4c5851a277fd41311c9e62d2c9492e1c4f3"
+  in
+  Alcotest.check cs "res_secret" expected
+    (Handshake_crypto13.res_secret hash res_master nonce)
+
+(* Test full derive chain matches RFC 8446 vectors *)
+let full_derive_chain () =
+  let t0 = Handshake_crypto13.empty cipher in
+  (* Early secret: extract with zero PSK *)
+  let t1 = Handshake_crypto13.derive t0 (String.make 32 '\x00') in
+  let expected_early =
+    Ohex.decode
+      "33ad0a1c607ec03b09e6cd9893680ce210adf300aa1f2660e1b22e10f170f92a"
+  in
+  Alcotest.check cs "early secret" expected_early t1.State.secret;
+  (* Handshake secret: derive + extract with ECDHE shared secret *)
+  let ikm =
+    Ohex.decode
+      "8bd4054fb55b9d63fdfbacf9f04b9f0d35e6d63f537563efd46272900f89492d"
+  in
+  let t2 = Handshake_crypto13.derive t1 ikm in
+  let expected_hs =
+    Ohex.decode
+      "1dc826e93606aa6fdc0aadc12f741b01046aa6b99f691ed221a9f0ca043fbeac"
+  in
+  Alcotest.check cs "handshake secret" expected_hs t2.State.secret;
+  (* Master secret *)
+  let t3 = Handshake_crypto13.derive t2 (String.make 32 '\x00') in
+  let expected_master =
+    Ohex.decode
+      "18df06843d13a08bf2a449844c5f8a478001bc4d4c627984d5a41da8d0402919"
+  in
+  Alcotest.check cs "master secret" expected_master t3.State.secret
+
+(* Test derive_secret with log data *)
+let derive_c_hs_traffic_from_log () =
+  let t0 = Handshake_crypto13.empty cipher in
+  let t1 = Handshake_crypto13.derive t0 (String.make 32 '\x00') in
+  let ikm =
+    Ohex.decode
+      "8bd4054fb55b9d63fdfbacf9f04b9f0d35e6d63f537563efd46272900f89492d"
+  in
+  let t2 = Handshake_crypto13.derive t1 ikm in
+  (* CH + SH from the RFC test vector *)
+  let ch =
+    Ohex.decode
+      "0100 00c0 0303 cb34 ecb1 e781 63ba 1c38c6da cb19 6a6d ffa2 1a8d 9912 \
+       ec18 a2ef6283 024d ece7 0000 0613 0113 0313 02010000 9100 0000 0b00 \
+       0900 0006 7365 72766572 ff01 0001 0000 0a00 1400 1200 1d001700 1800 \
+       1901 0001 0101 0201 0301 04002300 0000 3300 2600 2400 1d00 2099 \
+       381de560 e4bd 43d2 3d8e 435a 7dba feb3 c06e51c1 3cae 4d54 1369 1e52 \
+       9aaf 2c00 2b000302 0304 000d 0020 001e 0403 0503 06030203 0804 0805 \
+       0806 0401 0501 0601 02010402 0502 0602 0202 002d 0002 0101 001c0002 \
+       4001"
+  in
+  let sh =
+    Ohex.decode
+      "0200 0056 0303 a6af 06a4 1218 60dc 5e6e6024 9cd3 4c95 930c 8ac5 cb14 \
+       34da c155772e d3e2 6928 0013 0100 002e 0033 0024001d 0020 c982 8876 \
+       1120 95fe 6676 2bdbf7c6 72e1 56d6 cc25 3b83 3df1 dd69 b1b04e75 1f0f \
+       002b 0002 0304"
+  in
+  let log = ch ^ sh in
+  let c_hs_traffic = Handshake_crypto13.derive_secret t2 "c hs traffic" log in
+  let expected =
+    Ohex.decode
+      "b3eddb126e067f35a780b3abf45e2d8f3b1a950738f52e9600746a0e27a55a21"
+  in
+  Alcotest.check cs "c hs traffic" expected c_hs_traffic
+
+let tests =
+  [
+    ("empty state", `Quick, empty_state);
+    ("empty state SHA384", `Quick, empty_state_sha384);
+    ("derive early secret", `Quick, derive_early_secret);
+    ("derive 'derived' from early", `Quick, derive_derived_from_early);
+    ("extract handshake secret", `Quick, extract_handshake_secret);
+    ("traffic key client", `Quick, traffic_key_derivation);
+    ("traffic key server", `Quick, traffic_key_server);
+    ("expand key from traffic secret", `Quick, expand_key_from_traffic_secret);
+    ("finished key derivation", `Quick, finished_key_derivation);
+    ("derive master salt", `Quick, derive_master_salt);
+    ("extract master secret", `Quick, extract_master_secret);
+    ("res_secret derivation", `Quick, res_secret_derivation);
+    ("full derive chain", `Quick, full_derive_chain);
+    ("derive c_hs_traffic from log", `Quick, derive_c_hs_traffic_from_log);
+  ]
+
+let suite = ("handshake_crypto13", tests)

test/test_handshake_server.ml

···
-let () = ()
-let suite = ("handshake_server", [])
+open Tls
+
+(* Tests for TLS 1.2 server handshake helper functions.
+   The server module is mostly stateful, but we can test
+   the client_hello_valid function and ALPN negotiation
+   through the handshake_common module. *)
+
+(* Test client_hello_valid with a proper TLS 1.2 client hello *)
+let client_hello_valid_tls12 () =
+  let ch : Core.client_hello =
+    {
+      client_version = `TLS_1_2;
+      client_random = String.make 32 '\x00';
+      sessionid = None;
+      ciphersuites = [ Packet.TLS_RSA_WITH_AES_128_CBC_SHA ];
+      extensions =
+        [ `SignatureAlgorithms [ `RSA_PKCS1_SHA256 ]; `ExtendedMasterSecret ];
+    }
+  in
+  match Handshake_common.client_hello_valid `TLS_1_2 ch with
+  | Ok () -> ()
+  | Error _ -> Alcotest.fail "expected valid client hello"
+
+(* Test client_hello_valid rejects empty ciphersuites *)
+let client_hello_empty_ciphersuites () =
+  let ch : Core.client_hello =
+    {
+      client_version = `TLS_1_2;
+      client_random = String.make 32 '\x00';
+      sessionid = None;
+      ciphersuites = [];
+      extensions = [];
+    }
+  in
+  match Handshake_common.client_hello_valid `TLS_1_2 ch with
+  | Ok () -> Alcotest.fail "expected error for empty ciphersuites"
+  | Error _ -> ()
+
+(* Test client_hello_valid rejects unsupported cipher-only list *)
+let client_hello_no_supported_cipher () =
+  let ch : Core.client_hello =
+    {
+      client_version = `TLS_1_2;
+      client_random = String.make 32 '\x00';
+      sessionid = None;
+      (* Use FALLBACK_SCSV which is not a real cipher and won't be supported *)
+      ciphersuites = [ Packet.TLS_FALLBACK_SCSV ];
+      extensions = [];
+    }
+  in
+  match Handshake_common.client_hello_valid `TLS_1_2 ch with
+  | Ok () -> Alcotest.fail "expected error for unsupported ciphersuites"
+  | Error _ -> ()
+
+(* Test client_hello_valid rejects duplicate extensions *)
+let client_hello_dup_extensions () =
+  let ch : Core.client_hello =
+    {
+      client_version = `TLS_1_2;
+      client_random = String.make 32 '\x00';
+      sessionid = None;
+      ciphersuites = [ Packet.TLS_RSA_WITH_AES_128_CBC_SHA ];
+      extensions =
+        [
+          `SignatureAlgorithms [ `RSA_PKCS1_SHA256 ];
+          `SignatureAlgorithms [ `RSA_PKCS1_SHA384 ];
+        ];
+    }
+  in
+  match Handshake_common.client_hello_valid `TLS_1_2 ch with
+  | Ok () -> Alcotest.fail "expected error for duplicate extensions"
+  | Error _ -> ()
+
+(* Test ALPN protocol negotiation *)
+let alpn_negotiation_match () =
+  let null_auth ?ip:_ ~host:_ _certs = Ok None in
+  let config =
+    match
+      Config.client ~authenticator:null_auth
+        ~alpn_protocols:[ "h2"; "http/1.1" ] ()
+    with
+    | Ok c -> Config.of_client c
+    | Error (`Msg m) -> Alcotest.failf "config error: %s" m
+  in
+  let ch : Core.client_hello =
+    {
+      client_version = `TLS_1_2;
+      client_random = String.make 32 '\x00';
+      sessionid = None;
+      ciphersuites = [];
+      extensions = [ `ALPN [ "http/1.1"; "h2" ] ];
+    }
+  in
+  match Handshake_common.alpn_protocol config ch with
+  | Ok (Some proto) ->
+      (* Server picks first from its own list that client supports *)
+      Alcotest.(check string) "ALPN negotiated" "h2" proto
+  | Ok None -> Alcotest.fail "expected ALPN protocol"
+  | Error _ -> Alcotest.fail "ALPN negotiation error"
+
+let alpn_negotiation_no_match () =
+  let null_auth ?ip:_ ~host:_ _certs = Ok None in
+  let config =
+    match
+      Config.client ~authenticator:null_auth ~alpn_protocols:[ "h2" ] ()
+    with
+    | Ok c -> Config.of_client c
+    | Error (`Msg m) -> Alcotest.failf "config error: %s" m
+  in
+  let ch : Core.client_hello =
+    {
+      client_version = `TLS_1_2;
+      client_random = String.make 32 '\x00';
+      sessionid = None;
+      ciphersuites = [];
+      extensions = [ `ALPN [ "spdy/3.1" ] ];
+    }
+  in
+  match Handshake_common.alpn_protocol config ch with
+  | Ok _ -> Alcotest.fail "expected ALPN failure"
+  | Error _ -> ()
+
+let alpn_negotiation_none_configured () =
+  let null_auth ?ip:_ ~host:_ _certs = Ok None in
+  let config =
+    match Config.client ~authenticator:null_auth () with
+    | Ok c -> Config.of_client c
+    | Error (`Msg m) -> Alcotest.failf "config error: %s" m
+  in
+  let ch : Core.client_hello =
+    {
+      client_version = `TLS_1_2;
+      client_random = String.make 32 '\x00';
+      sessionid = None;
+      ciphersuites = [];
+      extensions = [ `ALPN [ "h2" ] ];
+    }
+  in
+  match Handshake_common.alpn_protocol config ch with
+  | Ok None -> ()
+  | Ok (Some _) -> Alcotest.fail "expected no ALPN when not configured"
+  | Error _ -> Alcotest.fail "unexpected error"
+
+(* Test empty_session has sensible defaults *)
+let empty_session_defaults () =
+  let s = Handshake_common.empty_session in
+  Alcotest.(check int)
+    "empty master secret" 0
+    (String.length s.common_session_data.master_secret);
+  Alcotest.(check bool) "no extended ms" false s.extended_ms;
+  Alcotest.(check bool)
+    "no peer cert" true
+    (s.common_session_data.peer_certificate = None);
+  Alcotest.(check bool) "empty reneg" true (s.renegotiation = ("", ""))
+
+(* Test client_hello_valid for TLS 1.0 (no sig algs required) *)
+let client_hello_valid_tls10 () =
+  let ch : Core.client_hello =
+    {
+      client_version = `TLS_1_0;
+      client_random = String.make 32 '\x00';
+      sessionid = None;
+      ciphersuites = [ Packet.TLS_RSA_WITH_AES_128_CBC_SHA ];
+      extensions = [];
+    }
+  in
+  match Handshake_common.client_hello_valid `TLS_1_0 ch with
+  | Ok () -> ()
+  | Error _ -> Alcotest.fail "expected valid TLS 1.0 client hello"
+
+(* Test version negotiation helpers from Core *)
+let version_comparison () =
+  Alcotest.(check int)
+    "1.0 < 1.1" (-1)
+    (Core.compare_tls_version `TLS_1_0 `TLS_1_1);
+  Alcotest.(check int)
+    "1.2 > 1.1" 1
+    (Core.compare_tls_version `TLS_1_2 `TLS_1_1);
+  Alcotest.(check int)
+    "1.3 = 1.3" 0
+    (Core.compare_tls_version `TLS_1_3 `TLS_1_3)
+
+let all_versions_range () =
+  let vs = Core.all_versions (`TLS_1_0, `TLS_1_3) in
+  Alcotest.(check int) "4 versions" 4 (List.length vs);
+  (* all_versions returns in descending order (highest first) *)
+  Alcotest.(check bool) "starts with 1.3" true (List.hd vs = `TLS_1_3)
+
+let all_versions_single () =
+  let vs = Core.all_versions (`TLS_1_2, `TLS_1_2) in
+  Alcotest.(check int) "1 version" 1 (List.length vs);
+  Alcotest.(check bool) "is 1.2" true (List.hd vs = `TLS_1_2)
+
+let tests =
+  [
+    ("CH valid TLS 1.2", `Quick, client_hello_valid_tls12);
+    ("CH empty ciphersuites", `Quick, client_hello_empty_ciphersuites);
+    ("CH no supported cipher", `Quick, client_hello_no_supported_cipher);
+    ("CH duplicate extensions", `Quick, client_hello_dup_extensions);
+    ("ALPN negotiation match", `Quick, alpn_negotiation_match);
+    ("ALPN negotiation no match", `Quick, alpn_negotiation_no_match);
+    ("ALPN none configured", `Quick, alpn_negotiation_none_configured);
+    ("empty session defaults", `Quick, empty_session_defaults);
+    ("CH valid TLS 1.0", `Quick, client_hello_valid_tls10);
+    ("version comparison", `Quick, version_comparison);
+    ("all_versions range", `Quick, all_versions_range);
+    ("all_versions single", `Quick, all_versions_single);
+  ]
+
+let suite = ("handshake_server", tests)

test/test_handshake_server13.ml

···
-let () = ()
-let suite = ("handshake_server13", [])
+open Tls
+
+(* Tests for TLS 1.3 server handshake.
+
+   The Handshake_server13 module constructs server hello messages
+   and manages the TLS 1.3 handshake state. We test the observable
+   properties of TLS 1.3 validation logic and key schedule. *)
+
+(* Test client_hello_valid for TLS 1.3 requires specific extensions *)
+let ch13_valid_with_all_extensions () =
+  let ch : Core.client_hello =
+    {
+      client_version = `TLS_1_2;
+      client_random = String.make 32 '\x00';
+      sessionid = None;
+      ciphersuites = [ Packet.TLS_AES_128_GCM_SHA256 ];
+      extensions =
+        [
+          `SignatureAlgorithms [ `RSA_PSS_RSAENC_SHA256 ];
+          `SupportedGroups [ Packet.X25519 ];
+          `KeyShare [ (Packet.X25519, String.make 32 '\x01') ];
+          `SupportedVersions [ `TLS_1_3 ];
+        ];
+    }
+  in
+  match Handshake_common.client_hello_valid `TLS_1_3 ch with
+  | Ok () -> ()
+  | Error _ -> Alcotest.fail "expected valid TLS 1.3 client hello"
+
+(* Test TLS 1.3 CH requires SignatureAlgorithms *)
+let ch13_missing_sig_algs () =
+  let ch : Core.client_hello =
+    {
+      client_version = `TLS_1_2;
+      client_random = String.make 32 '\x00';
+      sessionid = None;
+      ciphersuites = [ Packet.TLS_AES_128_GCM_SHA256 ];
+      extensions =
+        [
+          `SupportedGroups [ Packet.X25519 ];
+          `KeyShare [ (Packet.X25519, String.make 32 '\x01') ];
+        ];
+    }
+  in
+  match Handshake_common.client_hello_valid `TLS_1_3 ch with
+  | Ok () -> Alcotest.fail "expected error for missing sig algs"
+  | Error _ -> ()
+
+(* Test TLS 1.3 CH requires KeyShare *)
+let ch13_missing_keyshare () =
+  let ch : Core.client_hello =
+    {
+      client_version = `TLS_1_2;
+      client_random = String.make 32 '\x00';
+      sessionid = None;
+      ciphersuites = [ Packet.TLS_AES_128_GCM_SHA256 ];
+      extensions =
+        [
+          `SignatureAlgorithms [ `RSA_PSS_RSAENC_SHA256 ];
+          `SupportedGroups [ Packet.X25519 ];
+        ];
+    }
+  in
+  match Handshake_common.client_hello_valid `TLS_1_3 ch with
+  | Ok () -> Alcotest.fail "expected error for missing key share"
+  | Error _ -> ()
+
+(* Test TLS 1.3 CH requires SupportedGroups *)
+let ch13_missing_supported_groups () =
+  let ch : Core.client_hello =
+    {
+      client_version = `TLS_1_2;
+      client_random = String.make 32 '\x00';
+      sessionid = None;
+      ciphersuites = [ Packet.TLS_AES_128_GCM_SHA256 ];
+      extensions =
+        [
+          `SignatureAlgorithms [ `RSA_PSS_RSAENC_SHA256 ];
+          `KeyShare [ (Packet.X25519, String.make 32 '\x01') ];
+        ];
+    }
+  in
+  match Handshake_common.client_hello_valid `TLS_1_3 ch with
+  | Ok () -> Alcotest.fail "expected error for missing supported groups"
+  | Error _ -> ()
+
+(* Test TLS 1.3 CH requires key share groups to be subset of supported groups *)
+let ch13_keyshare_not_subset () =
+  let ch : Core.client_hello =
+    {
+      client_version = `TLS_1_2;
+      client_random = String.make 32 '\x00';
+      sessionid = None;
+      ciphersuites = [ Packet.TLS_AES_128_GCM_SHA256 ];
+      extensions =
+        [
+          `SignatureAlgorithms [ `RSA_PSS_RSAENC_SHA256 ];
+          `SupportedGroups [ Packet.SECP256R1 ];
+          (* key share for X25519 which is not in supported groups *)
+          `KeyShare [ (Packet.X25519, String.make 32 '\x01') ];
+        ];
+    }
+  in
+  match Handshake_common.client_hello_valid `TLS_1_3 ch with
+  | Ok () -> Alcotest.fail "expected error for keyshare not subset of groups"
+  | Error _ -> ()
+
+(* Test TLS 1.3 CH rejects duplicate groups *)
+let ch13_duplicate_groups () =
+  let ch : Core.client_hello =
+    {
+      client_version = `TLS_1_2;
+      client_random = String.make 32 '\x00';
+      sessionid = None;
+      ciphersuites = [ Packet.TLS_AES_128_GCM_SHA256 ];
+      extensions =
+        [
+          `SignatureAlgorithms [ `RSA_PSS_RSAENC_SHA256 ];
+          `SupportedGroups [ Packet.X25519; Packet.X25519 ];
+          `KeyShare [ (Packet.X25519, String.make 32 '\x01') ];
+        ];
+    }
+  in
+  match Handshake_common.client_hello_valid `TLS_1_3 ch with
+  | Ok () -> Alcotest.fail "expected error for duplicate groups"
+  | Error _ -> ()
+
+(* Test TLS 1.3 CH rejects duplicate key shares *)
+let ch13_duplicate_keyshares () =
+  let ch : Core.client_hello =
+    {
+      client_version = `TLS_1_2;
+      client_random = String.make 32 '\x00';
+      sessionid = None;
+      ciphersuites = [ Packet.TLS_AES_128_GCM_SHA256 ];
+      extensions =
+        [
+          `SignatureAlgorithms [ `RSA_PSS_RSAENC_SHA256 ];
+          `SupportedGroups [ Packet.X25519 ];
+          `KeyShare
+            [
+              (Packet.X25519, String.make 32 '\x01');
+              (Packet.X25519, String.make 32 '\x02');
+            ];
+        ];
+    }
+  in
+  match Handshake_common.client_hello_valid `TLS_1_3 ch with
+  | Ok () -> Alcotest.fail "expected error for duplicate key shares"
+  | Error _ -> ()
+
+(* Test empty_session13 has correct defaults *)
+let empty_session13_defaults () =
+  let s = Handshake_common.empty_session13 `AES_128_GCM_SHA256 in
+  Alcotest.(check bool)
+    "cipher matches" true
+    (s.ciphersuite13 = `AES_128_GCM_SHA256);
+  Alcotest.(check bool) "not resumed" false s.resumed;
+  Alcotest.(check bool) "state is established" true (s.state = `Established);
+  Alcotest.(check int)
+    "empty exporter secret" 0
+    (String.length s.exporter_master_secret)
+
+(* Test Core helper functions used in TLS 1.3 *)
+let named_group_roundtrip () =
+  let groups : Core.group list = [ `X25519; `P256; `P384; `P521; `FFDHE2048 ] in
+  List.iter
+    (fun g ->
+      let ng = Core.group_to_named_group g in
+      match Core.named_group_to_group ng with
+      | Some g' -> Alcotest.(check bool) "roundtrip" true (g = g')
+      | None -> Alcotest.failf "roundtrip failed for group")
+    groups
+
+(* Test pair_of_tls_version roundtrip *)
+let version_pair_roundtrip () =
+  let versions : Core.tls_version list =
+    [ `TLS_1_0; `TLS_1_1; `TLS_1_2; `TLS_1_3 ]
+  in
+  List.iter
+    (fun v ->
+      let pair = Core.pair_of_tls_version v in
+      match Core.tls_version_of_pair pair with
+      | Some v' -> Alcotest.(check bool) "roundtrip" true (v = v')
+      | None -> Alcotest.fail "version pair roundtrip failed")
+    versions
+
+(* Test tls13_sigalg filter *)
+let tls13_sigalg_filter () =
+  (* These should be valid TLS 1.3 sig algs *)
+  Alcotest.(check bool)
+    "RSA_PSS_SHA256" true
+    (Core.tls13_sigalg `RSA_PSS_RSAENC_SHA256);
+  Alcotest.(check bool)
+    "ECDSA_P256_SHA256" true
+    (Core.tls13_sigalg `ECDSA_SECP256R1_SHA256);
+  Alcotest.(check bool) "ED25519" true (Core.tls13_sigalg `ED25519);
+  (* These should NOT be valid TLS 1.3 sig algs *)
+  Alcotest.(check bool)
+    "RSA_PKCS1_SHA256" false
+    (Core.tls13_sigalg `RSA_PKCS1_SHA256);
+  Alcotest.(check bool) "RSA_PKCS1_MD5" false (Core.tls13_sigalg `RSA_PKCS1_MD5);
+  Alcotest.(check bool)
+    "ECDSA_SECP256R1_SHA1" false
+    (Core.tls13_sigalg `ECDSA_SECP256R1_SHA1)
+
+(* Test pk_matches_sa *)
+let pk_matches_sa_rsa () =
+  (* RSA key should match RSA sigalgs *)
+  let e = Crypto_pk.Z_extra.of_octets_be "\x01\x00\x01" in
+  let p = Crypto_pk.Z_extra.of_octets_be (String.make 64 '\xff') in
+  let q = Crypto_pk.Z_extra.of_octets_be (String.make 64 '\xfe') in
+  match Crypto_pk.Rsa.priv_of_primes ~e ~p ~q with
+  | Ok key ->
+      let pub = `RSA (Crypto_pk.Rsa.pub_of_priv key) in
+      Alcotest.(check bool)
+        "RSA matches RSA_PKCS1" true
+        (Core.pk_matches_sa pub `RSA_PKCS1_SHA256);
+      Alcotest.(check bool)
+        "RSA matches RSA_PSS" true
+        (Core.pk_matches_sa pub `RSA_PSS_RSAENC_SHA256);
+      Alcotest.(check bool)
+        "RSA does not match ECDSA" false
+        (Core.pk_matches_sa pub `ECDSA_SECP256R1_SHA256)
+  | Error _ ->
+      (* RSA key generation might fail with these dummy values *)
+      ()
+
+(* Test DH key generation produces valid keypairs *)
+let dh_gen_key_x25519 () =
+  let _secret, share = Handshake_crypto13.dh_gen_key `X25519 in
+  Alcotest.(check int) "X25519 share is 32 bytes" 32 (String.length share)
+
+let dh_gen_key_p256 () =
+  let _secret, share = Handshake_crypto13.dh_gen_key `P256 in
+  (* P256 uncompressed point: 1 byte prefix + 32 bytes x + 32 bytes y = 65 *)
+  Alcotest.(check int) "P256 share is 65 bytes" 65 (String.length share)
+
+let tests =
+  [
+    ("CH13 valid with all extensions", `Quick, ch13_valid_with_all_extensions);
+    ("CH13 missing sig algs", `Quick, ch13_missing_sig_algs);
+    ("CH13 missing keyshare", `Quick, ch13_missing_keyshare);
+    ("CH13 missing supported groups", `Quick, ch13_missing_supported_groups);
+    ("CH13 keyshare not subset", `Quick, ch13_keyshare_not_subset);
+    ("CH13 duplicate groups", `Quick, ch13_duplicate_groups);
+    ("CH13 duplicate keyshares", `Quick, ch13_duplicate_keyshares);
+    ("empty_session13 defaults", `Quick, empty_session13_defaults);
+    ("named group roundtrip", `Quick, named_group_roundtrip);
+    ("version pair roundtrip", `Quick, version_pair_roundtrip);
+    ("tls13_sigalg filter", `Quick, tls13_sigalg_filter);
+    ("pk_matches_sa RSA", `Quick, pk_matches_sa_rsa);
+    ("dh_gen_key X25519", `Quick, dh_gen_key_x25519);
+    ("dh_gen_key P256", `Quick, dh_gen_key_p256);
+  ]
+
+let suite = ("handshake_server13", tests)

test/test_utils.ml

···
-let () = ()
-let suite = ("utils", [])
+open Tls
+
+(* Test Utils.List_set.subset *)
+let subset_empty_is_subset_of_anything () =
+  Alcotest.(check bool)
+    "empty subset of empty" true
+    (Utils.List_set.subset [] []);
+  Alcotest.(check bool)
+    "empty subset of nonempty" true
+    (Utils.List_set.subset [] [ 1; 2; 3 ])
+
+let subset_self () =
+  Alcotest.(check bool)
+    "self is subset" true
+    (Utils.List_set.subset [ 1; 2; 3 ] [ 1; 2; 3 ])
+
+let subset_proper () =
+  Alcotest.(check bool)
+    "proper subset" true
+    (Utils.List_set.subset [ 1; 3 ] [ 1; 2; 3 ])
+
+let subset_not_subset () =
+  Alcotest.(check bool)
+    "not a subset" false
+    (Utils.List_set.subset [ 1; 4 ] [ 1; 2; 3 ])
+
+let subset_unordered () =
+  (* subset should sort internally, so order should not matter *)
+  Alcotest.(check bool)
+    "unordered subset" true
+    (Utils.List_set.subset [ 3; 1 ] [ 2; 1; 3 ])
+
+(* Test Utils.List_set.is_proper_set *)
+let is_proper_set_empty () =
+  Alcotest.(check bool) "empty is a set" true (Utils.List_set.is_proper_set [])
+
+let is_proper_set_singleton () =
+  Alcotest.(check bool)
+    "singleton is a set" true
+    (Utils.List_set.is_proper_set [ 1 ])
+
+let is_proper_set_no_duplicates () =
+  Alcotest.(check bool)
+    "no duplicates" true
+    (Utils.List_set.is_proper_set [ 1; 2; 3 ])
+
+let is_proper_set_with_duplicates () =
+  Alcotest.(check bool)
+    "has duplicates" false
+    (Utils.List_set.is_proper_set [ 1; 2; 2; 3 ])
+
+let is_proper_set_all_same () =
+  Alcotest.(check bool)
+    "all same" false
+    (Utils.List_set.is_proper_set [ 5; 5; 5 ])
+
+(* Test Utils.map_find *)
+let map_find_found () =
+  let result =
+    Utils.map_find ~f:(fun x -> if x > 3 then Some x else None) [ 1; 2; 4; 5 ]
+  in
+  Alcotest.(check (option int)) "finds first match" (Some 4) result
+
+let map_find_not_found () =
+  let result =
+    Utils.map_find ~f:(fun x -> if x > 10 then Some x else None) [ 1; 2; 3 ]
+  in
+  Alcotest.(check (option int)) "no match" None result
+
+let map_find_empty () =
+  let result = Utils.map_find ~f:(fun x -> Some x) [] in
+  Alcotest.(check (option int)) "empty list" None result
+
+(* Test Utils.init_and_last *)
+let init_and_last_empty () =
+  Alcotest.(check bool) "empty list" true (Utils.init_and_last [] = None)
+
+let init_and_last_singleton () =
+  match Utils.init_and_last [ 1 ] with
+  | Some (init, last) ->
+      Alcotest.(check (list int)) "init" [] init;
+      Alcotest.(check int) "last" 1 last
+  | None -> Alcotest.fail "expected Some"
+
+let init_and_last_multiple () =
+  match Utils.init_and_last [ 1; 2; 3; 4 ] with
+  | Some (init, last) ->
+      Alcotest.(check (list int)) "init" [ 1; 2; 3 ] init;
+      Alcotest.(check int) "last" 4 last
+  | None -> Alcotest.fail "expected Some"
+
+(* Test Utils.first_match *)
+let first_match_found () =
+  Alcotest.(check (option int))
+    "first match" (Some 2)
+    (Utils.first_match [ 1; 2; 3 ] [ 4; 2; 5 ])
+
+let first_match_not_found () =
+  Alcotest.(check (option int))
+    "no match" None
+    (Utils.first_match [ 1; 2 ] [ 4; 5; 6 ])
+
+let first_match_empty () =
+  Alcotest.(check (option int)) "empty l2" None (Utils.first_match [ 1 ] [])
+
+let first_match_returns_from_l2_order () =
+  (* first_match iterates l2 and checks membership in l1 *)
+  Alcotest.(check (option int))
+    "order from l2" (Some 3)
+    (Utils.first_match [ 1; 2; 3 ] [ 3; 2; 1 ])
+
+(* Test Utils.sub_equal *)
+let sub_equal_true () =
+  Alcotest.(check bool)
+    "sub_equal match" true
+    (Utils.sub_equal ~off:2 ~len:3 "llo" "hello world")
+
+let sub_equal_false () =
+  Alcotest.(check bool)
+    "sub_equal no match" false
+    (Utils.sub_equal ~off:0 ~len:3 "xyz" "hello")
+
+let sub_equal_at_start () =
+  Alcotest.(check bool)
+    "sub_equal at start" true
+    (Utils.sub_equal ~off:0 ~len:5 "hello" "hello world")
+
+let tests =
+  [
+    ( "subset: empty is subset of anything",
+      `Quick,
+      subset_empty_is_subset_of_anything );
+    ("subset: self", `Quick, subset_self);
+    ("subset: proper", `Quick, subset_proper);
+    ("subset: not subset", `Quick, subset_not_subset);
+    ("subset: unordered", `Quick, subset_unordered);
+    ("is_proper_set: empty", `Quick, is_proper_set_empty);
+    ("is_proper_set: singleton", `Quick, is_proper_set_singleton);
+    ("is_proper_set: no duplicates", `Quick, is_proper_set_no_duplicates);
+    ("is_proper_set: with duplicates", `Quick, is_proper_set_with_duplicates);
+    ("is_proper_set: all same", `Quick, is_proper_set_all_same);
+    ("map_find: found", `Quick, map_find_found);
+    ("map_find: not found", `Quick, map_find_not_found);
+    ("map_find: empty", `Quick, map_find_empty);
+    ("init_and_last: empty", `Quick, init_and_last_empty);
+    ("init_and_last: singleton", `Quick, init_and_last_singleton);
+    ("init_and_last: multiple", `Quick, init_and_last_multiple);
+    ("first_match: found", `Quick, first_match_found);
+    ("first_match: not found", `Quick, first_match_not_found);
+    ("first_match: empty", `Quick, first_match_empty);
+    ("first_match: order from l2", `Quick, first_match_returns_from_l2_order);
+    ("sub_equal: true", `Quick, sub_equal_true);
+    ("sub_equal: false", `Quick, sub_equal_false);
+    ("sub_equal: at start", `Quick, sub_equal_at_start);
+  ]
+
+let suite = ("utils", tests)