zfp

A TLS 1.3 server written in Zig that computes JA3 fingerprints of connecting clients.

Features

• Pure Zig implementation — zero external dependencies
• TLS 1.3 handshake with AES-128-GCM encryption
• X25519 and P-256 (secp256r1) key exchange
• JA3 fingerprint extraction with GREASE filtering

Requirements

• Zig 0.16.0-dev or later

Build

zig build

Run

./zig-out/bin/zfp

The server listens on https://localhost:9876.

Usage

curl -k https://localhost:9876

Response:

JA3 Hash: 42cb4ba4c818da3ce6424cb212377c24
JA3 String: 771,4866-4867-4865-...

Project Structure

src/
├── main.zig          # Entry point and connection handler
├── root.zig          # Library exports
├── ja3.zig           # JA3 fingerprint computation
├── client_hello.zig  # ClientHello message parsing
├── handshake.zig     # TLS handshake message builders
├── key_schedule.zig  # TLS 1.3 key derivation (HKDF)
├── key_exchange.zig  # ECDHE key exchange (X25519, P-256)
├── record.zig        # TLS record layer (read/write/encrypt/decrypt)
└── cert.zig          # Embedded self-signed certificate

Example Fingerprints