anchor.diff:      %% PRK = HandshakeSecret
       %% hash = CHSTHash
       SHSTInfo =
  -        hexstr2bin("00201274" "6c733133" "20732068" "73207472"
  -                   "61666669" "6320860c" "06edc078" "58ee8e78"
  -                   "f0e7428c" "58edd6b4" "3f2ca3e6" "e95f02ed"
  -                   "063cf0e1" "cad8"),
  +        hexstr2bin("00 20 12 74 6c 73 31 33 20 73 20 68 73 20 74 72
  +          61 66 66 69 63 20 86 0c 06 ed c0 78 58 ee 8e 78 f0 e7 42 8c 58
  +          ed d6 b4 3f 2c a3 e6 e9 5f 02 ed 06 3c f0 e1 ca d8"),
   
       SHSTrafficSecret =
  -        hexstr2bin("b67b7d69" "0cc16c4e" "75e54213" "cb2d37b4"
  -                   "e9c912bc" "ded9105d" "42befd59" "d391ad38"),
  +        hexstr2bin("b6 7b 7d 69 0c c1 6c 4e 75 e5 42 13 cb 2d
  +          37 b4 e9 c9 12 bc de d9 10 5d 42 be fd 59 d3 91 ad 38"),
   
       SHSTInfo =  tls_v1:create_info(<<"s hs traffic">>, CHSTHash,  ssl_cipher:hash_size(HKDFAlgo)),
   
       SHSTrafficSecret =
           tls_v1:server_handshake_traffic_secret(HKDFAlgo, {handshake_secret, HandshakeSecret}, CHSH),
  +
  +
  +    %% {server}  derive secret for master "tls13 derived":
  +    %%
  +    %%    PRK (32 octets):  1d c8 26 e9 36 06 aa 6f dc 0a ad c1 2f 74 1b 01
  +    %%       04 6a a6 b9 9f 69 1e d2 21 a9 f0 ca 04 3f be ac
  +    %%
  +    %%    hash (32 octets):  e3 b0 c4 42 98 fc 1c 14 9a fb f4 c8 99 6f b9 24
  +    %%       27 ae 41 e4 64 9b 93 4c a4 95 99 1b 78 52 b8 55
  +    %%
  +    %%    info (49 octets):  00 20 0d 74 6c 73 31 33 20 64 65 72 69 76 65 64
  +    %%       20 e3 b0 c4 42 98 fc 1c 14 9a fb f4 c8 99 6f b9 24 27 ae 41 e4
  +    %%       64 9b 93 4c a4 95 99 1b 78 52 b8 55
  +    %%
  +    %%    expanded (32 octets):  43 de 77 e0 c7 77 13 85 9a 94 4d b9 db 25
  +    %%       90 b5 31 90 a6 5b 3e e2 e4 f1 2d d7 a0 bb 7c e2 54 b4
  +
  +    %% PRK = HandshakeSecret
  +    %% hash = Hash
  +    %% info = Info
  +    MasterDeriveSecret =
  +        hexstr2bin("43 de 77 e0 c7 77 13 85 9a 94 4d b9 db 25
  +          90 b5 31 90 a6 5b 3e e2 e4 f1 2d d7 a0 bb 7c e2 54 b4"),
  +
  +    MasterDeriveSecret = tls_v1:derive_secret(HandshakeSecret, <<"derived">>, <<>>, HKDFAlgo),
  +
  +    %% {server}  extract secret "master":
  +    %%
  +    %%    salt (32 octets):  43 de 77 e0 c7 77 13 85 9a 94 4d b9 db 25 90 b5
  +    %%       31 90 a6 5b 3e e2 e4 f1 2d d7 a0 bb 7c e2 54 b4
  +    %%
  +    %%    IKM (32 octets):  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  +    %%       00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  +    %%
  +    %%    secret (32 octets):  18 df 06 84 3d 13 a0 8b f2 a4 49 84 4c 5f 8a
  +    %%       47 80 01 bc 4d 4c 62 79 84 d5 a4 1d a8 d0 40 29 19
  +
  +    %% salt = MasterDeriveSecret
  +    %% IKM = IKM
  +    MasterSecret =
  +        hexstr2bin("18 df 06 84 3d 13 a0 8b f2 a4 49 84 4c 5f 8a
  +          47 80 01 bc 4d 4c 62 79 84 d5 a4 1d a8 d0 40 29 19"),
  +
  +    {master_secret, MasterSecret} =
  +        tls_v1:key_schedule(master_secret, HKDFAlgo, {handshake_secret, HandshakeSecret}),
  +
  +    %% {server}  send handshake record:
  +    %%
  +    %%    payload (90 octets):  02 00 00 56 03 03 a6 af 06 a4 12 18 60 dc 5e
  +    %%       6e 60 24 9c d3 4c 95 93 0c 8a c5 cb 14 34 da c1 55 77 2e d3 e2
  +    %%       69 28 00 13 01 00 00 2e 00 33 00 24 00 1d 00 20 c9 82 88 76 11
  +    %%       20 95 fe 66 76 2b db f7 c6 72 e1 56 d6 cc 25 3b 83 3d f1 dd 69
  +    %%       b1 b0 4e 75 1f 0f 00 2b 00 02 03 04
  +    %%
  +    %%    complete record (95 octets):  16 03 03 00 5a 02 00 00 56 03 03 a6
  +    %%       af 06 a4 12 18 60 dc 5e 6e 60 24 9c d3 4c 95 93 0c 8a c5 cb 14
  +    %%       34 da c1 55 77 2e d3 e2 69 28 00 13 01 00 00 2e 00 33 00 24 00
  +    %%       1d 00 20 c9 82 88 76 11 20 95 fe 66 76 2b db f7 c6 72 e1 56 d6
  +    %%       cc 25 3b 83 3d f1 dd 69 b1 b0 4e 75 1f 0f 00 2b 00 02 03 04
  +
  +    %% payload = ServerHello
  +    ServerHelloRecord =
  +        hexstr2bin("16 03 03 00 5a 02 00 00 56 03 03 a6
  +          af 06 a4 12 18 60 dc 5e 6e 60 24 9c d3 4c 95 93 0c 8a c5 cb 14
  +          34 da c1 55 77 2e d3 e2 69 28 00 13 01 00 00 2e 00 33 00 24 00
  +          1d 00 20 c9 82 88 76 11 20 95 fe 66 76 2b db f7 c6 72 e1 56 d6
  +          cc 25 3b 83 3d f1 dd 69 b1 b0 4e 75 1f 0f 00 2b 00 02 03 04"),
  +
  +    {SHEncrypted, _} =
  +	tls_record:encode_handshake(ServerHello, {3,4}, ConnStatesNull),
  +    ServerHelloRecord = iolist_to_binary(SHEncrypted),
   
       %% {server}  derive write traffic keys for handshake data:
       %%
  
positive.code:     Salt = binary:copy(<<?BYTE(0)>>, 32),
      IKM = binary:copy(<<?BYTE(0)>>, 32),
      EarlySecret =
          hexstr2bin("33ad0a1c" "607ec03b" "09e6cd98" "93680ce2"
                     "10adf300" "aa1f2660" "e1b22e10" "f170f92a"),
      {early_secret, EarlySecret} = tls_v1:key_schedule(early_secret, HKDFAlgo, {psk, Salt}),
  
      %% Get 'ECPrivateKey'{}
      %%
      %% -record('ECPrivateKey', {
      %%   version,
      %%   privateKey,
      %%   parameters = asn1_NOVALUE,
      %%   publicKey = asn1_NOVALUE
      %% }).
  
      %% {client}  create an ephemeral x25519 key pair:
      %%
  
negative.code: 
      %% salt = Expanded
      HandshakeIKM =
          hexstr2bin("8b d4 05 4f b5 5b 9d 63 fd fb ac f9 f0 4b 9f 0d
            35 e6 d6 3f 53 75 63 ef d4 62 72 90 0f 89 49 2d"),
  
      HandshakeSecret =
          hexstr2bin("1d c8 26 e9 36 06 aa 6f dc 0a ad c1 2f 74 1b
            01 04 6a a6 b9 9f 69 1e d2 21 a9 f0 ca 04 3f be ac"),
  
      HandshakeIKM = crypto:compute_key(ecdh, CPublicKey, SPrivateKey, x25519),
  
  