for i, test := range testKeysFromTests {
		in, _ := hex.DecodeString(test.preMasterSecret)
		clientRandom, _ := hex.DecodeString(test.clientRandom)
		serverRandom, _ := hex.DecodeString(test.serverRandom)

		masterSecret := masterFromPreMasterSecret(test.version, test.suite, in, clientRandom, serverRandom)
		if s := hex.EncodeToString(masterSecret); s != test.masterSecret {
			t.Errorf("#%d: bad master secret %s, want %s", i, s, test.masterSecret)

// secret. See RFC 5246, Section 8.1.
func masterFromPreMasterSecret(version uint16, suite *cipherSuite, preMasterSecret, clientRandom, serverRandom []byte) []byte {
	seed := make([]byte, 0, len(clientRandom)+len(serverRandom))
	seed = append(seed, clientRandom...)
	seed = append(seed, serverRandom...)

	masterSecret := make([]byte, masterSecretLength)
	prfForVersion(version, suite)(masterSecret, preMasterSecret, masterSecretLabel, seed)

	}

	hs.hello.random = make([]byte, 32)
	serverRandom := hs.hello.random
	// Downgrade protection canaries. See RFC 8446, Section 4.1.3.
	maxVers := c.config.maxSupportedVersion(roleServer)
	if maxVers >= VersionTLS12 && c.vers < maxVers || testingOnlyForceDowngradeCanary {
		if c.vers == VersionTLS12 {
			copy(serverRandom[24:], downgradeCanaryTLS12)
		} else {
			copy(serverRandom[24:], downgradeCanaryTLS11)
		}