ssl: Implement TLS 1.3 state machine skeleton

Change-Id: I4b382a7907247cc2099951fdefa40f1511b1123e

11 files changed, 521 insertions, 56 deletions

diff --git a/lib/ssl/src/Makefile b/lib/ssl/src/Makefile
index 0d4f49608d..c7dee81c71 100644
--- a/lib/ssl/src/Makefile
+++ b/lib/ssl/src/Makefile
@@ -65,6 +65,7 @@ MODULES= \
 	ssl_cipher_format \
 	ssl_srp_primes \
 	tls_connection \
+	tls_connection_1_3 \
 	dtls_connection \
 	tls_sender\
 	ssl_config \
@@ -171,6 +172,7 @@ $(EBIN)/ssl_certificate.$(EMULATOR): ssl_internal.hrl ssl_alert.hrl ssl_handshak
 $(EBIN)/ssl_certificate_db.$(EMULATOR): ssl_internal.hrl ../../public_key/include/public_key.hrl ../../kernel/include/file.hrl
 $(EBIN)/ssl_cipher.$(EMULATOR): ssl_internal.hrl ssl_record.hrl ssl_cipher.hrl ssl_handshake.hrl ssl_alert.hrl ../../public_key/include/public_key.hrl
 $(EBIN)/tls_connection.$(EMULATOR): ssl_internal.hrl tls_connection.hrl tls_record.hrl ssl_cipher.hrl tls_handshake.hrl ssl_alert.hrl ../../public_key/include/public_key.hrl
+$(EBIN)/tls_connection_1_3.$(EMULATOR): ssl_internal.hrl tls_connection.hrl
 $(EBIN)/dtls_connection.$(EMULATOR): ssl_internal.hrl dtls_connection.hrl dtls_record.hrl ssl_cipher.hrl dtls_handshake.hrl ssl_alert.hrl ../../public_key/include/public_key.hrl
 $(EBIN)/tls_handshake.$(EMULATOR): ssl_internal.hrl tls_record.hrl ssl_cipher.hrl tls_handshake.hrl ssl_alert.hrl ../../public_key/include/public_key.hrl
 $(EBIN)/tls_handshake.$(EMULATOR): ssl_internal.hrl ssl_connection.hrl ssl_record.hrl ssl_cipher.hrl ssl_handshake.hrl ssl_alert.hrl ../../public_key/include/public_key.hrl
diff --git a/lib/ssl/src/ssl.app.src b/lib/ssl/src/ssl.app.src
index 4b7241c405..e7a4d73ec4 100644
--- a/lib/ssl/src/ssl.app.src
+++ b/lib/ssl/src/ssl.app.src
@@ -4,6 +4,7 @@
     {modules, [
 	       %% TLS/SSL 
 	       tls_connection,
+	       tls_connection_1_3,
 	       tls_handshake,
 	       tls_handshake_1_3,
 	       tls_record,
diff --git a/lib/ssl/src/ssl.erl b/lib/ssl/src/ssl.erl
index 3319aadd68..524f06d52e 100644
--- a/lib/ssl/src/ssl.erl
+++ b/lib/ssl/src/ssl.erl
@@ -51,7 +51,7 @@
 %% SSL/TLS protocol handling
 -export([cipher_suites/0, cipher_suites/1, cipher_suites/2, filter_cipher_suites/2,
          prepend_cipher_suites/2, append_cipher_suites/2,
-         eccs/0, eccs/1, versions/0, 
+         eccs/0, eccs/1, versions/0, groups/0,
          format_error/1, renegotiate/1, prf/5, negotiated_protocol/1, 
 	 connection_information/1, connection_information/2]).
 %% Misc
@@ -578,6 +578,13 @@ eccs_filter_supported(Curves) ->
                  Curves).
 
 %%--------------------------------------------------------------------
+-spec groups() -> tls_v1:supported_groups().
+%% Description: returns all supported groups (TLS 1.3 and later)
+%%--------------------------------------------------------------------
+groups() ->
+    tls_v1:groups(4).
+
+%%--------------------------------------------------------------------
 -spec getopts(#sslsocket{}, [gen_tcp:option_name()]) ->
 		     {ok, [gen_tcp:option()]} | {error, reason()}.
 %%
@@ -980,6 +987,9 @@ handle_options(Opts0, Role, Host) ->
 						      HighestVersion),
 		    eccs       = handle_eccs_option(proplists:get_value(eccs, Opts, eccs()),
                                                     HighestVersion),
+                    supported_groups = handle_supported_groups_option(
+                                         proplists:get_value(supported_groups, Opts, groups()),
+                                         HighestVersion),
 		    signature_algs =
                          handle_hashsigns_option(
                            proplists:get_value(
@@ -1058,7 +1068,8 @@ handle_options(Opts0, Role, Host) ->
 		  client_preferred_next_protocols, log_alert, log_level,
 		  server_name_indication, honor_cipher_order, padding_check, crl_check, crl_cache,
 		  fallback, signature_algs, signature_algs_cert, eccs, honor_ecc_order,
-                  beast_mitigation, max_handshake_size, handshake, customize_hostname_check],
+                  beast_mitigation, max_handshake_size, handshake, customize_hostname_check,
+                  supported_groups],
     SockOpts = lists:foldl(fun(Key, PropList) ->
 				   proplists:delete(Key, PropList)
 			   end, Opts, SslOptions),
@@ -1492,6 +1503,16 @@ handle_eccs_option(Value, Version) when is_list(Value) ->
         error:_ -> throw({error, {options, {eccs, Value}}})
     end.
 
+handle_supported_groups_option(Value, Version) when is_list(Value) ->
+    {_Major, Minor} = tls_version(Version),
+    try tls_v1:groups(Minor, Value) of
+        Groups -> #supported_groups{supported_groups = Groups}
+    catch
+        exit:_ -> throw({error, {options, {supported_groups, Value}}});
+        error:_ -> throw({error, {options, {supported_groups, Value}}})
+    end.
+
+
 unexpected_format(Error) ->
     lists:flatten(io_lib:format("Unexpected error: ~p", [Error])).
 
@@ -1653,6 +1674,12 @@ new_ssl_options([{eccs, Value} | Rest], #ssl_options{} = Opts, RecordCB) ->
 			 handle_eccs_option(Value, RecordCB:highest_protocol_version())
 		    },
 		    RecordCB);
+new_ssl_options([{supported_groups, Value} | Rest], #ssl_options{} = Opts, RecordCB) ->
+    new_ssl_options(Rest,
+		    Opts#ssl_options{supported_groups =
+			 handle_supported_groups_option(Value, RecordCB:highest_protocol_version())
+		    },
+		    RecordCB);
 new_ssl_options([{signature_algs, Value} | Rest], #ssl_options{} = Opts, RecordCB) -> 
     new_ssl_options(Rest, 
 		    Opts#ssl_options{signature_algs = 
diff --git a/lib/ssl/src/ssl_handshake.erl b/lib/ssl/src/ssl_handshake.erl
index 1e57dfd710..360c82084c 100644
--- a/lib/ssl/src/ssl_handshake.erl
+++ b/lib/ssl/src/ssl_handshake.erl
@@ -620,6 +620,14 @@ encode_extensions([#elliptic_curves{elliptic_curve_list = EllipticCurves} | Rest
     Len = ListLen + 2,
     encode_extensions(Rest, <<?UINT16(?ELLIPTIC_CURVES_EXT),
 				 ?UINT16(Len), ?UINT16(ListLen), EllipticCurveList/binary, Acc/binary>>);
+encode_extensions([#supported_groups{supported_groups = SupportedGroups} | Rest], Acc) ->
+
+    SupportedGroupList = << <<(tls_v1:group_to_enum(X)):16>> || X <- SupportedGroups>>,
+    ListLen = byte_size(SupportedGroupList),
+    Len = ListLen + 2,
+    encode_extensions(Rest, <<?UINT16(?ELLIPTIC_CURVES_EXT),
+                              ?UINT16(Len), ?UINT16(ListLen), 
+                              SupportedGroupList/binary, Acc/binary>>);
 encode_extensions([#ec_point_formats{ec_point_format_list = ECPointFormats} | Rest], Acc) ->
     ECPointFormatList = list_to_binary(ECPointFormats),
     ListLen = byte_size(ECPointFormatList),
@@ -983,43 +991,78 @@ premaster_secret(EncSecret, #'RSAPrivateKey'{} = RSAPrivateKey) ->
 %%====================================================================
 %% Extensions handling
 %%====================================================================
-client_hello_extensions(Version, CipherSuites, 
-			#ssl_options{signature_algs = SupportedHashSigns,
-                                     signature_algs_cert = SignatureSchemes,
-				     eccs = SupportedECCs,
-                                     versions = Versions} = SslOpts, ConnectionStates, Renegotiation) ->
-    {EcPointFormats, EllipticCurves} =
-	case advertises_ec_ciphers(lists:map(fun ssl_cipher_format:suite_definition/1, CipherSuites)) of
-	    true ->
-		client_ecc_extensions(SupportedECCs);
-	    false ->
-		{undefined, undefined}
-	end,
+client_hello_extensions(Version, CipherSuites, SslOpts, ConnectionStates, Renegotiation) ->
+    HelloExtensions0 = add_tls12_extensions(Version, SslOpts, ConnectionStates, Renegotiation),
+    HelloExtensions1 = add_common_extensions(Version, HelloExtensions0, CipherSuites, SslOpts),
+    maybe_add_tls13_extensions(Version, HelloExtensions1, SslOpts).
+
+
+add_tls12_extensions(Version,
+                     #ssl_options{signature_algs = SupportedHashSigns} = SslOpts,
+                     ConnectionStates,
+                     Renegotiation) ->
     SRP = srp_user(SslOpts),
+    #{renegotiation_info => renegotiation_info(tls_record, client,
+                                               ConnectionStates, Renegotiation),
+      srp => SRP,
+      signature_algs => available_signature_algs(SupportedHashSigns, Version),
+      alpn => encode_alpn(SslOpts#ssl_options.alpn_advertised_protocols, Renegotiation),
+      next_protocol_negotiation =>
+          encode_client_protocol_negotiation(SslOpts#ssl_options.next_protocol_selector,
+                                             Renegotiation),
+      sni => sni(SslOpts#ssl_options.server_name_indication)
+     }.
+
+
+add_common_extensions({3,4} = Version,
+                      HelloExtensions,
+                      _CipherSuites,
+                      #ssl_options{eccs = SupportedECCs,
+                                   supported_groups = Groups}) ->
+    {EcPointFormats, EllipticCurves} =
+        client_ecc_extensions(SupportedECCs),
+    HelloExtensions#{ec_point_formats => EcPointFormats,
+                     elliptic_curves => maybe_supported_groups(Version,
+                                                               EllipticCurves,
+                                                               Groups)};
+
+add_common_extensions(Version,
+                      HelloExtensions,
+                      CipherSuites,
+                      #ssl_options{eccs = SupportedECCs,
+                                   supported_groups = Groups}) ->
+
+    {EcPointFormats, EllipticCurves} =
+        case advertises_ec_ciphers(
+               lists:map(fun ssl_cipher_format:suite_definition/1,
+                         CipherSuites)) of
+            true ->
+                client_ecc_extensions(SupportedECCs);
+            false ->
+                {undefined, undefined}
+        end,
+    HelloExtensions#{ec_point_formats => EcPointFormats,
+                     elliptic_curves => maybe_supported_groups(Version,
+                                                               EllipticCurves,
+                                                               Groups)}.
+
+
+maybe_add_tls13_extensions({3,4},
+                           HelloExtensions,
+                           #ssl_options{signature_algs_cert = SignatureSchemes,
+                                        versions = SupportedVersions}) ->
+    HelloExtensions#{client_hello_versions => 
+                         #client_hello_versions{versions = SupportedVersions},
+                     signature_algs_cert =>
+                         signature_scheme_list(SignatureSchemes)};
+maybe_add_tls13_extensions(_, HelloExtensions, _) ->
+    HelloExtensions.
+
+maybe_supported_groups({3,4}, _, SupportedGroups) ->
+    SupportedGroups;
+maybe_supported_groups(_, EllipticCurves, _) ->
+    EllipticCurves.
 
-    HelloExtensions = #{renegotiation_info => renegotiation_info(tls_record, client,
-                                                                 ConnectionStates, Renegotiation),
-                        srp => SRP,
-                        signature_algs => available_signature_algs(SupportedHashSigns, Version),
-                        ec_point_formats => EcPointFormats,
-                        elliptic_curves => EllipticCurves,
-                        alpn => encode_alpn(SslOpts#ssl_options.alpn_advertised_protocols, Renegotiation),
-                        next_protocol_negotiation =>
-                            encode_client_protocol_negotiation(SslOpts#ssl_options.next_protocol_selector,
-                                                               Renegotiation),
-                        sni => sni(SslOpts#ssl_options.server_name_indication)
-                       },
-
-    %% Add "supported_versions" extension if TLS 1.3
-    case Version of
-        {3,4} ->
-            HelloExtensions#{client_hello_versions => 
-                                 #client_hello_versions{versions = Versions},
-                             signature_algs_cert =>
-                                 signature_scheme_list(SignatureSchemes)};
-        _Else ->
-            HelloExtensions
-    end.
 
 signature_scheme_list(undefined) ->
     undefined;
@@ -1299,6 +1342,8 @@ extension_value(#ec_point_formats{ec_point_format_list = List}) ->
     List;
 extension_value(#elliptic_curves{elliptic_curve_list = List}) ->
     List;
+extension_value(#supported_groups{supported_groups = SupportedGroups}) ->
+    SupportedGroups;
 extension_value(#hash_sign_algos{hash_sign_algos = Algos}) ->
     Algos;
 extension_value(#alpn{extension_data = Data}) ->
@@ -2520,6 +2565,11 @@ client_ecc_extensions(SupportedECCs) ->
     CryptoSupport = proplists:get_value(public_keys, crypto:supports()),
     case proplists:get_bool(ecdh, CryptoSupport) of
 	true ->
+            %% RFC 8422 - 5.1.  Client Hello Extensions
+            %% Clients SHOULD send both the Supported Elliptic Curves Extension and the
+            %% Supported Point Formats Extension.  If the Supported Point Formats
+            %% Extension is indeed sent, it MUST contain the value 0 (uncompressed)
+            %% as one of the items in the list of point formats.
 	    EcPointFormats = #ec_point_formats{ec_point_format_list = [?ECPOINT_UNCOMPRESSED]},
 	    EllipticCurves = SupportedECCs,
 	    {EcPointFormats, EllipticCurves};
diff --git a/lib/ssl/src/ssl_handshake.hrl b/lib/ssl/src/ssl_handshake.hrl
index 0e44e27653..81ff73baf9 100644
--- a/lib/ssl/src/ssl_handshake.hrl
+++ b/lib/ssl/src/ssl_handshake.hrl
@@ -340,9 +340,8 @@
 -record(next_protocol, {selected_protocol}).
 
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
-%% ECC Extensions RFC 8422  section 4 and 5 (RFC 7919 not supported)
+%% ECC Extensions RFC 8422  section 4 and 5
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
-
 -define(ELLIPTIC_CURVES_EXT, 10).
 -define(EC_POINT_FORMATS_EXT, 11).
 
@@ -350,11 +349,18 @@
 	  elliptic_curve_list
 	 }).
 
+%% RFC 8446 (TLS 1.3) renamed the "elliptic_curve" extension.
+-record(supported_groups, {
+	  supported_groups
+	 }).
+
 -record(ec_point_formats, {
 	  ec_point_format_list
 	 }).
 
 -define(ECPOINT_UNCOMPRESSED, 0).
+%% Defined in RFC 4492, deprecated by RFC 8422
+%% RFC 8422 compliant implementations MUST not support the two formats below
 -define(ECPOINT_ANSIX962_COMPRESSED_PRIME, 1).
 -define(ECPOINT_ANSIX962_COMPRESSED_CHAR2, 2).
 
diff --git a/lib/ssl/src/ssl_internal.hrl b/lib/ssl/src/ssl_internal.hrl
index 5a18f6aa99..48798799f7 100644
--- a/lib/ssl/src/ssl_internal.hrl
+++ b/lib/ssl/src/ssl_internal.hrl
@@ -170,6 +170,7 @@
 	  signature_algs,
 	  signature_algs_cert,
 	  eccs,
+	  supported_groups,  %% RFC 8422, RFC 8446
 	  honor_ecc_order            :: boolean(),
           max_handshake_size         :: integer(),
           handshake,
diff --git a/lib/ssl/src/tls_connection.erl b/lib/ssl/src/tls_connection.erl
index af59dda442..298758ea38 100644
--- a/lib/ssl/src/tls_connection.erl
+++ b/lib/ssl/src/tls_connection.erl
@@ -69,6 +69,22 @@
 -export([init/3, error/3, downgrade/3, %% Initiation and take down states
 	 hello/3, user_hello/3, certify/3, cipher/3, abbreviated/3, %% Handshake states 
 	 connection/3]).
+%% TLS 1.3 state functions (server)
+-export([start/3,         %% common state with client
+         negotiated/3,
+         recvd_ch/3,
+         wait_cert/3,     %% common state with client
+         wait_cv/3,       %% common state with client
+         wait_eoed/3,
+         wait_finished/3, %% common state with client
+         wait_flight2/3,
+         connected/3      %% common state with client
+        ]).
+%% TLS 1.3 state functions (client)
+-export([wait_cert_cr/3,
+         wait_ee/3,
+         wait_sh/3
+        ]).
 %% gen_statem callbacks
 -export([callback_mode/0, terminate/3, code_change/4, format_status/2]).
  
@@ -560,7 +576,7 @@ hello(internal, #client_hello{client_version = ClientVersion} = Hello,
                                             State#state{negotiated_version
                                                         = ClientVersion});
         {Version, {Type, Session},
-	 ConnectionStates, Protocol0, ServerHelloExt, HashSign} ->
+	 ConnectionStates, Protocol0, ServerHelloExt, HashSign} when Version < {3,4} ->
 	    Protocol = case Protocol0 of
 			   undefined -> CurrentProtocol;
 			   _ -> Protocol0
@@ -571,7 +587,23 @@ hello(internal, #client_hello{client_version = ClientVersion} = Hello,
                                       hashsign_algorithm = HashSign,
                                       client_hello_version = ClientVersion,
                                       session = Session,
-                                      negotiated_protocol = Protocol})
+                                      negotiated_protocol = Protocol});
+        %% TLS 1.3
+        {Version, {Type, Session},
+	 ConnectionStates, Protocol0, ServerHelloExt, HashSign} ->
+	    Protocol = case Protocol0 of
+			   undefined -> CurrentProtocol;
+			   _ -> Protocol0
+		       end,
+            tls_connection_1_3:gen_handshake(?FUNCTION_NAME,
+                                             internal,
+                                             {common_client_hello, Type, ServerHelloExt},
+                                             State#state{connection_states  = ConnectionStates,
+                                                         negotiated_version = Version,
+                                                         hashsign_algorithm = HashSign,
+                                                         client_hello_version = ClientVersion,
+                                                         session = Session,
+                                                         negotiated_protocol = Protocol})
     end;
 hello(internal, #server_hello{} = Hello,      
       #state{connection_states = ConnectionStates0,
@@ -683,6 +715,117 @@ connection(Type, Event, State) ->
 downgrade(Type, Event, State) ->
      ssl_connection:?FUNCTION_NAME(Type, Event, State, ?MODULE).
 
+%%--------------------------------------------------------------------
+%% TLS 1.3 state functions
+%%--------------------------------------------------------------------
+%%--------------------------------------------------------------------
+-spec start(gen_statem:event_type(), term(), #state{}) ->
+			 gen_statem:state_function_result().
+%%--------------------------------------------------------------------
+start(info, Event, State) ->
+    gen_info(Event, ?FUNCTION_NAME, State);
+start(Type, Event, State) ->
+    gen_handshake(?FUNCTION_NAME, Type, Event, State).
+
+%%--------------------------------------------------------------------
+-spec negotiated(gen_statem:event_type(), term(), #state{}) ->
+			 gen_statem:state_function_result().
+%%--------------------------------------------------------------------
+negotiated(info, Event, State) ->
+    gen_info(Event, ?FUNCTION_NAME, State);
+negotiated(Type, Event, State) ->
+    gen_handshake(?FUNCTION_NAME, Type, Event, State).
+
+%%--------------------------------------------------------------------
+-spec recvd_ch(gen_statem:event_type(), term(), #state{}) ->
+			 gen_statem:state_function_result().
+%%--------------------------------------------------------------------
+recvd_ch(info, Event, State) ->
+    gen_info(Event, ?FUNCTION_NAME, State);
+recvd_ch(Type, Event, State) ->
+    gen_handshake(?FUNCTION_NAME, Type, Event, State).
+
+%%--------------------------------------------------------------------
+-spec wait_cert(gen_statem:event_type(), term(), #state{}) ->
+			 gen_statem:state_function_result().
+%%--------------------------------------------------------------------
+wait_cert(info, Event, State) ->
+    gen_info(Event, ?FUNCTION_NAME, State);
+wait_cert(Type, Event, State) ->
+    gen_handshake(?FUNCTION_NAME, Type, Event, State).
+
+%%--------------------------------------------------------------------
+-spec wait_cv(gen_statem:event_type(), term(), #state{}) ->
+			 gen_statem:state_function_result().
+%%--------------------------------------------------------------------
+wait_cv(info, Event, State) ->
+    gen_info(Event, ?FUNCTION_NAME, State);
+wait_cv(Type, Event, State) ->
+    gen_handshake(?FUNCTION_NAME, Type, Event, State).
+
+%%--------------------------------------------------------------------
+-spec wait_eoed(gen_statem:event_type(), term(), #state{}) ->
+			 gen_statem:state_function_result().
+%%--------------------------------------------------------------------
+wait_eoed(info, Event, State) ->
+    gen_info(Event, ?FUNCTION_NAME, State);
+wait_eoed(Type, Event, State) ->
+    gen_handshake(?FUNCTION_NAME, Type, Event, State).
+
+%%--------------------------------------------------------------------
+-spec wait_finished(gen_statem:event_type(), term(), #state{}) ->
+			 gen_statem:state_function_result().
+%%--------------------------------------------------------------------
+wait_finished(info, Event, State) ->
+    gen_info(Event, ?FUNCTION_NAME, State);
+wait_finished(Type, Event, State) ->
+    gen_handshake(?FUNCTION_NAME, Type, Event, State).
+
+%%--------------------------------------------------------------------
+-spec wait_flight2(gen_statem:event_type(), term(), #state{}) ->
+			 gen_statem:state_function_result().
+%%--------------------------------------------------------------------
+wait_flight2(info, Event, State) ->
+    gen_info(Event, ?FUNCTION_NAME, State);
+wait_flight2(Type, Event, State) ->
+    gen_handshake(?FUNCTION_NAME, Type, Event, State).
+
+%%--------------------------------------------------------------------
+-spec connected(gen_statem:event_type(), term(), #state{}) ->
+			 gen_statem:state_function_result().
+%%--------------------------------------------------------------------
+connected(info, Event, State) ->
+    gen_info(Event, ?FUNCTION_NAME, State);
+connected(Type, Event, State) ->
+    gen_handshake(?FUNCTION_NAME, Type, Event, State).
+
+%%--------------------------------------------------------------------
+-spec wait_cert_cr(gen_statem:event_type(), term(), #state{}) ->
+			 gen_statem:state_function_result().
+%%--------------------------------------------------------------------
+wait_cert_cr(info, Event, State) ->
+    gen_info(Event, ?FUNCTION_NAME, State);
+wait_cert_cr(Type, Event, State) ->
+    gen_handshake(?FUNCTION_NAME, Type, Event, State).
+
+%%--------------------------------------------------------------------
+-spec wait_ee(gen_statem:event_type(), term(), #state{}) ->
+			 gen_statem:state_function_result().
+%%--------------------------------------------------------------------
+wait_ee(info, Event, State) ->
+    gen_info(Event, ?FUNCTION_NAME, State);
+wait_ee(Type, Event, State) ->
+    gen_handshake(?FUNCTION_NAME, Type, Event, State).
+
+%%--------------------------------------------------------------------
+-spec wait_sh(gen_statem:event_type(), term(), #state{}) ->
+			 gen_statem:state_function_result().
+%%--------------------------------------------------------------------
+wait_sh(info, Event, State) ->
+    gen_info(Event, ?FUNCTION_NAME, State);
+wait_sh(Type, Event, State) ->
+    gen_handshake(?FUNCTION_NAME, Type, Event, State).
+
 %--------------------------------------------------------------------
 %% gen_statem callbacks
 %%--------------------------------------------------------------------
diff --git a/lib/ssl/src/tls_connection_1_3.erl b/lib/ssl/src/tls_connection_1_3.erl
new file mode 100644
index 0000000000..c8732e7847
--- /dev/null
+++ b/lib/ssl/src/tls_connection_1_3.erl
@@ -0,0 +1,159 @@
+%%
+%% %CopyrightBegin%
+%%
+%% Copyright Ericsson AB 2007-2018. All Rights Reserved.
+%%
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
+%%
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
+%%
+%% %CopyrightEnd%
+%%
+
+%%
+%%----------------------------------------------------------------------
+%% Purpose: TODO
+%%----------------------------------------------------------------------
+
+%% RFC 8446
+%% A.1.  Client
+%%
+%%                               START <----+
+%%                Send ClientHello |        | Recv HelloRetryRequest
+%%           [K_send = early data] |        |
+%%                                 v        |
+%%            /                 WAIT_SH ----+
+%%            |                    | Recv ServerHello
+%%            |                    | K_recv = handshake
+%%        Can |                    V
+%%       send |                 WAIT_EE
+%%      early |                    | Recv EncryptedExtensions
+%%       data |           +--------+--------+
+%%            |     Using |                 | Using certificate
+%%            |       PSK |                 v
+%%            |           |            WAIT_CERT_CR
+%%            |           |        Recv |       | Recv CertificateRequest
+%%            |           | Certificate |       v
+%%            |           |             |    WAIT_CERT
+%%            |           |             |       | Recv Certificate
+%%            |           |             v       v
+%%            |           |              WAIT_CV
+%%            |           |                 | Recv CertificateVerify
+%%            |           +> WAIT_FINISHED <+
+%%            |                  | Recv Finished
+%%            \                  | [Send EndOfEarlyData]
+%%                               | K_send = handshake
+%%                               | [Send Certificate [+ CertificateVerify]]
+%%     Can send                  | Send Finished
+%%     app data   -->            | K_send = K_recv = application
+%%     after here                v
+%%                           CONNECTED
+%%
+%% A.2.  Server
+%%
+%%                               START <-----+
+%%                Recv ClientHello |         | Send HelloRetryRequest
+%%                                 v         |
+%%                              RECVD_CH ----+
+%%                                 | Select parameters
+%%                                 v
+%%                              NEGOTIATED
+%%                                 | Send ServerHello
+%%                                 | K_send = handshake
+%%                                 | Send EncryptedExtensions
+%%                                 | [Send CertificateRequest]
+%%  Can send                       | [Send Certificate + CertificateVerify]
+%%  app data                       | Send Finished
+%%  after   -->                    | K_send = application
+%%  here                  +--------+--------+
+%%               No 0-RTT |                 | 0-RTT
+%%                        |                 |
+%%    K_recv = handshake  |                 | K_recv = early data
+%%  [Skip decrypt errors] |    +------> WAIT_EOED -+
+%%                        |    |       Recv |      | Recv EndOfEarlyData
+%%                        |    | early data |      | K_recv = handshake
+%%                        |    +------------+      |
+%%                        |                        |
+%%                        +> WAIT_FLIGHT2 <--------+
+%%                                 |
+%%                        +--------+--------+
+%%                No auth |                 | Client auth
+%%                        |                 |
+%%                        |                 v
+%%                        |             WAIT_CERT
+%%                        |        Recv |       | Recv Certificate
+%%                        |       empty |       v
+%%                        | Certificate |    WAIT_CV
+%%                        |             |       | Recv
+%%                        |             v       | CertificateVerify
+%%                        +-> WAIT_FINISHED <---+
+%%                                 | Recv Finished
+%%                                 | K_recv = application
+%%                                 v
+%%                             CONNECTED
+
+-module(tls_connection_1_3).
+
+-include("ssl_alert.hrl").
+-include("ssl_connection.hrl").
+
+-export([hello/4]).
+-export([gen_handshake/4]).
+
+hello(internal, {common_client_hello, Type, ServerHelloExt}, State, Connection) ->
+    do_server_hello(Type, ServerHelloExt, State, Connection).
+
+do_server_hello(Type, #{next_protocol_negotiation := _NextProtocols} =
+                    _ServerHelloExt,
+		#state{negotiated_version = _Version,
+		       session = #session{session_id = _SessId},
+		       connection_states = _ConnectionStates0,
+                       ssl_options = #ssl_options{versions = [_HighestVersion|_]}}
+		= State0, _Connection) when is_atom(Type) ->
+%%                              NEGOTIATED
+%%                                 | Send ServerHello
+%%                                 | K_send = handshake
+%%                                 | Send EncryptedExtensions
+%%                                 | [Send CertificateRequest]
+%%  Can send                       | [Send Certificate + CertificateVerify]
+%%  app data                       | Send Finished
+%%  after   -->                    | K_send = application
+%%  here                  +--------+--------+
+%%               No 0-RTT |                 | 0-RTT
+%%                        |                 |
+%%    K_recv = handshake  |                 | K_recv = early data
+%%  [Skip decrypt errors] |    +------> WAIT_EOED -+
+%%                        |    |       Recv |      | Recv EndOfEarlyData
+%%                        |    | early data |      | K_recv = handshake
+%%                        |    +------------+      |
+%%                        |                        |
+%%                        +> WAIT_FLIGHT2 <--------+
+    %% Will be called implicitly
+    %% {Record, State} = Connection:next_record(State2#state{session = Session}),
+    %% Connection:next_event(wait_flight2, Record, State, Actions),
+    %% OR
+    %% Connection:next_event(WAIT_EOED, Record, State, Actions)
+    {next_state, wait_flight2, State0, []}.
+    %% TODO: Add new states to tls_connection!
+    %% State0.
+
+
+gen_handshake(StateName, Type, Event,
+	      #state{negotiated_version = Version} = State) ->
+    try tls_connection_1_3:StateName(Type, Event, State, ?MODULE) of
+	Result ->
+	    Result
+    catch
+	_:_ ->
+            ssl_connection:handle_own_alert(?ALERT_REC(?FATAL, ?HANDSHAKE_FAILURE,
+						       malformed_handshake_data),
+					    Version, StateName, State)
+    end.
diff --git a/lib/ssl/src/tls_handshake.erl b/lib/ssl/src/tls_handshake.erl
index b39a7732e7..37f13fcbac 100644
--- a/lib/ssl/src/tls_handshake.erl
+++ b/lib/ssl/src/tls_handshake.erl
@@ -260,6 +260,8 @@ get_tls_handshake(Version, Data, Buffer, Options) ->
 %%--------------------------------------------------------------------
 %%% Internal functions
 %%--------------------------------------------------------------------
+handle_client_hello(Version = {3,4}, ClientHello, SslOpts, Info, Renegotiation) ->
+    tls_handshake_1_3:handle_client_hello(Version, ClientHello, SslOpts, Info, Renegotiation);
 handle_client_hello(Version, 
                     #client_hello{session_id = SugesstedId,
                                   cipher_suites = CipherSuites,
@@ -341,26 +343,19 @@ handle_server_hello_extensions(Version, SessionId, Random, CipherSuite,
 do_hello(undefined, _Versions, _CipherSuites, _Hello, _SslOpts, _Info, _Renegotiation) ->
     ?ALERT_REC(?FATAL, ?PROTOCOL_VERSION);
 do_hello(Version, Versions, CipherSuites, Hello, SslOpts, Info, Renegotiation) ->
-    case tls_record:is_higher({3,4}, Version) of
-        true -> %% TLS 1.2 and older
-            case ssl_cipher:is_fallback(CipherSuites) of
+    case ssl_cipher:is_fallback(CipherSuites) of
+        true ->
+            Highest = tls_record:highest_protocol_version(Versions),
+            case tls_record:is_higher(Highest, Version) of
                 true ->
-                    Highest = tls_record:highest_protocol_version(Versions),
-                    case tls_record:is_higher(Highest, Version) of
-                        true ->
-                            ?ALERT_REC(?FATAL, ?INAPPROPRIATE_FALLBACK);
-                        false ->
-                            handle_client_hello(Version, Hello, SslOpts, Info, Renegotiation)
-                    end;
+                    ?ALERT_REC(?FATAL, ?INAPPROPRIATE_FALLBACK);
                 false ->
                     handle_client_hello(Version, Hello, SslOpts, Info, Renegotiation)
             end;
         false ->
-            %% Implement TLS 1.3 statem ???
-            ?ALERT_REC(?FATAL, ?PROTOCOL_VERSION)
+            handle_client_hello(Version, Hello, SslOpts, Info, Renegotiation)
     end.
 
-
 %%--------------------------------------------------------------------
 enc_handshake(#hello_request{}, {3, N}) when N < 4 ->
     {?HELLO_REQUEST, <<>>};
diff --git a/lib/ssl/src/tls_handshake_1_3.erl b/lib/ssl/src/tls_handshake_1_3.erl
index 199054b43b..b9ebf2e502 100644
--- a/lib/ssl/src/tls_handshake_1_3.erl
+++ b/lib/ssl/src/tls_handshake_1_3.erl
@@ -33,6 +33,9 @@
 %% Encode
 -export([encode_handshake/1, decode_handshake/2]).
 
+%% Handshake
+-export([handle_client_hello/5]).
+
 encode_handshake(#certificate_request_1_3{
                     certificate_request_context = Context, 
                     extensions = Exts})->
@@ -151,3 +154,47 @@ decode_extensions(Exts) ->
 
 extensions_list(HelloExtensions) ->
     [Ext || {_, Ext} <- maps:to_list(HelloExtensions)].
+
+
+handle_client_hello(Version,
+                    #client_hello{session_id = SugesstedId,
+                                  cipher_suites = CipherSuites,
+                                  compression_methods = Compressions,
+                                  random = Random,
+                                  extensions = HelloExt},
+		    #ssl_options{versions = Versions,
+				 signature_algs = SupportedHashSigns,
+				 eccs = SupportedECCs,
+				 honor_ecc_order = ECCOrder} = SslOpts,
+		    {Port, Session0, Cache, CacheCb, ConnectionStates0, Cert, _},
+                    Renegotiation) ->
+    case tls_record:is_acceptable_version(Version, Versions) of
+	true ->
+            %% Get supported_groups
+            %% SupportedGroups = maps:get(elliptic_curves, HelloExt, undefined),
+            %% Get KeyShareClientHello
+
+            %% Validate supported_groups + KeyShareClientHello
+            %% IF valid THEN
+            %%   IF supported_groups IS empty send HelloRetryRequest
+            %%   ELSE continue
+            %% ELSE
+            %%   send Alert
+            %% ClientHashSigns = maps:get(signature_algs, HelloExt, undefined),
+            %% ClientSignatureSchemes = maps:get(signature_algs_cert, HelloExt, undefined),
+
+            %% Implement session handling.
+
+            %% Select curve
+
+            %% Sessions cannot be resumed by ClientHello
+
+            %% Select cipher_suite
+            %% Select hash_sign
+
+            %% Handle extensions
+	    ok;
+	false ->
+	    ?ALERT_REC(?FATAL, ?PROTOCOL_VERSION)
+    end.
+
diff --git a/lib/ssl/src/tls_v1.erl b/lib/ssl/src/tls_v1.erl
index 7d28962d2d..a535df3dc3 100644
--- a/lib/ssl/src/tls_v1.erl
+++ b/lib/ssl/src/tls_v1.erl
@@ -33,7 +33,8 @@
 	 setup_keys/8, suites/1, prf/5,
 	 ecc_curves/1, ecc_curves/2, oid_to_enum/1, enum_to_oid/1, 
 	 default_signature_algs/1, signature_algs/2,
-         default_signature_schemes/1, signature_schemes/2]).
+         default_signature_schemes/1, signature_schemes/2,
+         groups/1, group_to_enum/1]).
 
 -type named_curve() :: sect571r1 | sect571k1 | secp521r1 | brainpoolP512r1 |
                        sect409k1 | sect409r1 | brainpoolP384r1 | secp384r1 |
@@ -42,7 +43,10 @@
                        sect193r1 | sect193r2 | secp192k1 | secp192r1 | sect163k1 |
                        sect163r1 | sect163r2 | secp160k1 | secp160r1 | secp160r2.
 -type curves() :: [named_curve()].
--export_type([curves/0, named_curve/0]).
+-type group() :: secp256r1 | secp384r1 | secp521r1 | ffdhe2048 |
+                 ffdhe3072 | ffdhe4096 | ffdhe6144 | ffdhe8192.
+-type supported_groups() :: [group()].
+-export_type([curves/0, named_curve/0, group/0, supported_groups/0]).
 
 %%====================================================================
 %% Internal application API
@@ -468,6 +472,7 @@ ecc_curves(all) ->
      sect239k1,sect233k1,sect233r1,secp224k1,secp224r1,
      sect193r1,sect193r2,secp192k1,secp192r1,sect163k1,
      sect163r1,sect163r2,secp160k1,secp160r1,secp160r2];
+
 ecc_curves(Minor) ->
     TLSCurves = ecc_curves(all),
     ecc_curves(Minor, TLSCurves).
@@ -482,6 +487,35 @@ ecc_curves(_Minor, TLSCurves) ->
 			end
 		end, [], TLSCurves).
 
+-spec groups(4 | all) -> [group()].
+groups(all) ->
+    [secp256r1,
+     secp384r1,
+     secp521r1,
+     ffdhe2048,
+     ffdhe3072,
+     ffdhe4096,
+     ffdhe6144,
+     ffdhe8192];
+groups(Minor) ->
+    TLSGroups = groups(all),
+    groups(Minor, TLSGroups).
+%%
+-spec groups(4, [group()]) -> [group()].
+groups(_Minor, TLSGroups) ->
+    %% TODO: Adding FFDHE groups to crypto?
+    CryptoGroups = crypto:ec_curves() ++ [ffdhe2048,ffdhe3072,ffdhe4096,ffdhe6144,ffdhe8192],
+    lists:filter(fun(Group) -> proplists:get_bool(Group, CryptoGroups) end, TLSGroups).
+
+group_to_enum(secp256r1) -> 23;
+group_to_enum(secp384r1) -> 24;
+group_to_enum(secp521r1) -> 25;
+group_to_enum(ffdhe2048) -> 256;
+group_to_enum(ffdhe3072) -> 257;
+group_to_enum(ffdhe4096) -> 258;
+group_to_enum(ffdhe6144) -> 259;
+group_to_enum(ffdhe8192) -> 260.
+
 
 %% ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005)
 oid_to_enum(?sect163k1) -> 1;