QSslKeyingMaterial Class

Detailed Description

QSslKeyingMaterial represents a request for keying material derived from an established TLS connection using the TLS exporter mechanism.

The exporter mechanism is defined in RFC 5705 for TLS 1.2 and earlier and in RFC 8446 for TLS 1.3. It allows applications to derive cryptographically separate keying material from the TLS session without exposing the session's traffic keys.

Each QSslKeyingMaterial object specifies:

• an exporter label identifying the purpose of the derived keying material
• an optional context value binding the keying material to application-specific data
• the desired size of the exported keying material

The actual keying material is derived by the TLS backend after a successful handshake and can be retrieved via value().

QSslKeyingMaterial objects are typically configured via QSslConfiguration::setKeyingMaterial() before initiating a TLS connection.

Example: Deterministic export on client and server

 // Both client and server configure the same label and optional context
 QSslKeyingMaterial keying("session-label", 32, "app-specific-context");

 // After the TLS handshake completes get data from QSslConfiguration.
 QByteArray derived = sslConfiguration().keyingMaterial(keying)->value();

 // Both client and server will obtain the same 'derived' bytes
 // even though they each performed the derivation independently.
 qDebug() << "Derived keying material:" << derived;