Decouple the handshake buffer and digest.

The handshake hash is initialized from the buffer as soon as the cipher
is known. When adding a message to the transcript, independently update
the buffer and rolling hash, whichever is active. This avoids the
complications around dont_free_handshake_buffer and EMS.


Change-Id: I3b1065796a50fd1be5d42ead7210c2f253ef0aca
Reviewed-by: Adam Langley <>
11 files changed