From QUIC draft 29:
The secrets for the Initial encryption level are computed based on the client’s initial Destination Connection ID, as described in Section 5.2.
There is also an example about the secrets of initial packets, and I used openssl APIs to demonstrate it:
# ./main
initial_secret(32): 1e7e7764529715b1e0ddc8e9753c61576769605187793ed366f8bbf8c9e986eb
client_in_secret(32): 0088119288f1d866733ceeed15ff9d50902cf82952eee27e9d4d4918ea371d87
quic_key(16): 175257a31eb09dea9366d8bb79ad80ba
quic_iv(12): 6b26114b9cba2b63a9e8dd4f
quic_hp(16): 9ddd12c994c0698b89374a9c077a3077
P.S., the code can be downloaded here.
References:
What am I doing wrong?;
HKDF context re-use issue;
HKDF实现.
