JarryShaw · Sep 29, 2026 · Sep 28, 2026
diff --git a/docs/source/pcapkit/const/pcapng.rst b/docs/source/pcapkit/const/pcapng.rst
@@ -24,6 +24,8 @@ enumerations include:
      - Secrets Types [*]_
    * - :class:`PCAPNG_FilterType <pcapkit.const.pcapng.filter_type.FilterType>`
      - Filter Types [*]_
+   * - :class:`PCAPNG_TLSKeyLabel <pcapkit.const.pcapng.tls_key_label.TLSKeyLabel>`
+     - TLS Key Log Labels [*]_
 
 Block Types
 ===========
@@ -116,6 +118,19 @@ which is automatically generated from :class:`pcapkit.vendor.pcapng.filter_type.
    :undoc-members:
    :show-inheritance:
 
+TLS Key Log Labels
+===================
+
+.. module:: pcapkit.const.pcapng.tls_key_label
+
+This module contains the constant enumeration for **TLS Key Log Labels**,
+which is automatically generated from :class:`pcapkit.vendor.pcapng.tls_key_label.TLSKeyLabel`.
+
+.. autoclass:: pcapkit.const.pcapng.tls_key_label.TLSKeyLabel
+   :members:
+   :undoc-members:
+   :show-inheritance:
+
 .. raw:: html
 
    <br />
@@ -127,3 +142,4 @@ which is automatically generated from :class:`pcapkit.vendor.pcapng.filter_type.
 .. [*] https://www.ietf.org/archive/id/draft-tuexen-opsawg-pcapng-03.html#name-name-resolution-block
 .. [*] https://www.ietf.org/archive/id/draft-tuexen-opsawg-pcapng-03.html#name-decryption-secrets-block
 .. [*] https://www.ietf.org/archive/id/draft-tuexen-opsawg-pcapng-03.html#name-interface-description-block
+.. [*] https://www.iana.org/assignments/tls-parameters/tls-sslkeylogfile-labels.csv, c.f., :rfc:`9850#section-4.2`
diff --git a/docs/source/pcapkit/protocols/misc/pcapng.rst b/docs/source/pcapkit/protocols/misc/pcapng.rst
@@ -197,10 +197,12 @@ Auxiliary Data
    :undoc-members:
    :show-inheritance:
 
-.. autoclass:: pcapkit.protocols.misc.pcapng.TLSKeyLabel
-   :members:
-   :undoc-members:
-   :show-inheritance:
+:class:`TLSKeyLabel <pcapkit.const.pcapng.tls_key_label.TLSKeyLabel>` moved to
+:mod:`pcapkit.const.pcapng.tls_key_label` (GitHub issue #886), generated the
+same way as its :mod:`pcapkit.const.pcapng` siblings since :rfc:`9850#section-4.2`
+makes it an IANA registry rather than a hand-picked helper enum. This module
+still re-exports it under its own name, so
+``from pcapkit.protocols.misc.pcapng import TLSKeyLabel`` keeps working.
 
 .. autoclass:: pcapkit.protocols.misc.pcapng.WireGuardKeyLabel
    :members:

diff --git a/docs/source/pcapkit/vendor/pcapng.rst b/docs/source/pcapkit/vendor/pcapng.rst
@@ -24,6 +24,8 @@ vendor crawlers include:
      - Secrets Types [*]_
    * - :class:`PCAPNG_FilterType <pcapkit.vendor.pcapng.filter_type.FilterType>`
      - Filter Types [*]_
+   * - :class:`PCAPNG_TLSKeyLabel <pcapkit.vendor.pcapng.tls_key_label.TLSKeyLabel>`
+     - TLS Key Log Labels [*]_
 
 .. note::
 
@@ -124,6 +126,18 @@ which is automatically generating :class:`pcapkit.const.pcapng.filter_type.Filte
    :members: FLAG
    :show-inheritance:
 
+TLS Key Log Labels
+===================
+
+.. module:: pcapkit.vendor.pcapng.tls_key_label
+
+This module contains the vendor crawler for **TLS Key Log Labels**,
+which is automatically generating :class:`pcapkit.const.pcapng.tls_key_label.TLSKeyLabel`.
+
+.. autoclass:: pcapkit.vendor.pcapng.tls_key_label.TLSKeyLabel
+   :members: LINK
+   :show-inheritance:
+
 .. rubric:: Footnotes
 
 .. [*] https://www.ietf.org/archive/id/draft-tuexen-opsawg-pcapng-03.html#name-standardized-block-type-cod
@@ -133,3 +147,4 @@ which is automatically generating :class:`pcapkit.const.pcapng.filter_type.Filte
 .. [*] https://www.ietf.org/archive/id/draft-tuexen-opsawg-pcapng-03.html#name-name-resolution-block
 .. [*] https://www.ietf.org/archive/id/draft-tuexen-opsawg-pcapng-03.html#name-decryption-secrets-block
 .. [*] https://www.ietf.org/archive/id/draft-tuexen-opsawg-pcapng-03.html#name-interface-description-block
+.. [*] https://www.iana.org/assignments/tls-parameters/tls-sslkeylogfile-labels.csv, c.f., :rfc:`9850#section-4.2`
diff --git a/pcapkit/const/__init__.py b/pcapkit/const/__init__.py
@@ -83,5 +83,5 @@
     # PCAPNG
     'PCAPNG_BlockType', 'PCAPNG_OptionType', 'PCAPNG_HashAlgorithm',
     'PCAPNG_VerdictType', 'PCAPNG_RecordType', 'PCAPNG_SecretsType',
-    'PCAPNG_FilterType',
+    'PCAPNG_FilterType', 'PCAPNG_TLSKeyLabel',
 ]
diff --git a/pcapkit/const/pcapng/__init__.py b/pcapkit/const/pcapng/__init__.py
@@ -25,6 +25,8 @@
      - Secrets Types [*]_
    * - :class:`PCAPNG_FilterType <pcapkit.const.pcapng.filter_type.FilterType>`
      - Filter Types [*]_
+   * - :class:`PCAPNG_TLSKeyLabel <pcapkit.const.pcapng.tls_key_label.TLSKeyLabel>`
+     - TLS Key Log Labels [*]_
 
 .. [*] https://www.ietf.org/archive/id/draft-tuexen-opsawg-pcapng-03.html#name-standardized-block-type-cod
 .. [*] https://www.ietf.org/archive/id/draft-tuexen-opsawg-pcapng-03.html#name-options
@@ -33,6 +35,7 @@
 .. [*] https://www.ietf.org/archive/id/draft-tuexen-opsawg-pcapng-03.html#name-name-resolution-block
 .. [*] https://www.ietf.org/archive/id/draft-tuexen-opsawg-pcapng-03.html#name-decryption-secrets-block
 .. [*] https://www.ietf.org/archive/id/draft-tuexen-opsawg-pcapng-03.html#name-interface-description-block
+.. [*] https://www.iana.org/assignments/tls-parameters/tls-sslkeylogfile-labels.csv, c.f., :rfc:`9850#section-4.2`
 
 """
 
@@ -42,10 +45,11 @@
 from pcapkit.const.pcapng.option_type import OptionType as PCAPNG_OptionType
 from pcapkit.const.pcapng.record_type import RecordType as PCAPNG_RecordType
 from pcapkit.const.pcapng.secrets_type import SecretsType as PCAPNG_SecretsType
+from pcapkit.const.pcapng.tls_key_label import TLSKeyLabel as PCAPNG_TLSKeyLabel
 from pcapkit.const.pcapng.verdict_type import VerdictType as PCAPNG_VerdictType
 
 __all__ = [
     'PCAPNG_BlockType', 'PCAPNG_OptionType', 'PCAPNG_HashAlgorithm',
     'PCAPNG_VerdictType', 'PCAPNG_RecordType', 'PCAPNG_SecretsType',
-    'PCAPNG_FilterType',
+    'PCAPNG_FilterType', 'PCAPNG_TLSKeyLabel',
 ]
diff --git a/pcapkit/const/pcapng/tls_key_label.py b/pcapkit/const/pcapng/tls_key_label.py
@@ -0,0 +1,59 @@
+# -*- coding: utf-8 -*-
+# pylint: disable=line-too-long,consider-using-f-string
+"""TLS Key Log Labels
+========================
+
+.. module:: pcapkit.const.pcapng.tls_key_label
+
+This module contains the constant enumeration for **TLS Key Log Labels**,
+which is automatically generated from :class:`pcapkit.vendor.pcapng.tls_key_label.TLSKeyLabel`.
+
+"""
+
+from aenum import StrEnum
+
+from pcapkit.corekit.enum import EnumRegistry
+
+__all__ = ['TLSKeyLabel']
+
+
+class TLSKeyLabel(EnumRegistry, StrEnum):
+    """[TLSKeyLabel] TLS Key Log Labels"""
+
+    #: NSS-historical: not a registered label of :rfc:`9850#section-4.2`'s "TLS
+    #: SSLKEYLOGFILE Labels" registry. Defined by the Mozilla NSS
+    #: ``SSLKEYLOGFILE`` convention and removed in NSS 3.34; kept here only so
+    #: that key logs predating :rfc:`9850` still read.
+    RSA = 'RSA'
+
+    #: Master secret in TLS 1.2 and earlier, c.f., :rfc:`9850#section-4.2`.
+    CLIENT_RANDOM = 'CLIENT_RANDOM'
+
+    #: Secret for client early data records, c.f., :rfc:`9850#section-4.2`.
+    CLIENT_EARLY_TRAFFIC_SECRET = 'CLIENT_EARLY_TRAFFIC_SECRET'  # nosec B105
+
+    #: Early exporter secret, c.f., :rfc:`9850#section-4.2`.
+    EARLY_EXPORTER_SECRET = 'EARLY_EXPORTER_SECRET'  # nosec B105
+
+    #: Secret protecting client handshake, c.f., :rfc:`9850#section-4.2`.
+    CLIENT_HANDSHAKE_TRAFFIC_SECRET = 'CLIENT_HANDSHAKE_TRAFFIC_SECRET'  # nosec B105
+
+    #: Secret protecting server handshake, c.f., :rfc:`9850#section-4.2`.
+    SERVER_HANDSHAKE_TRAFFIC_SECRET = 'SERVER_HANDSHAKE_TRAFFIC_SECRET'  # nosec B105
+
+    #: Secret protecting client records post handshake, c.f.,
+    #: :rfc:`9850#section-4.2`.
+    CLIENT_TRAFFIC_SECRET_0 = 'CLIENT_TRAFFIC_SECRET_0'  # nosec B105
+
+    #: Secret protecting server records post handshake, c.f.,
+    #: :rfc:`9850#section-4.2`.
+    SERVER_TRAFFIC_SECRET_0 = 'SERVER_TRAFFIC_SECRET_0'  # nosec B105
+
+    #: Exporter secret after handshake, c.f., :rfc:`9850#section-4.2`.
+    EXPORTER_SECRET = 'EXPORTER_SECRET'  # nosec B105
+
+    #: HPKE KEM shared secret used in the ECH, c.f., :rfc:`9850#section-4.2`.
+    ECH_SECRET = 'ECH_SECRET'  # nosec B105
+
+    #: ECHConfig used for construction of the ECH, c.f., :rfc:`9850#section-4.2`.
+    ECH_CONFIG = 'ECH_CONFIG'
diff --git a/pcapkit/foundation/reassembly/data/data.py b/pcapkit/foundation/reassembly/data/data.py
@@ -38,13 +38,23 @@ class Completion(StrEnum):
     against a member instead.
 
     It derives from :class:`~pcapkit.utilities.compat.StrEnum`, as
-    :class:`~pcapkit.protocols.application.httpv1.Type` and
-    :class:`~pcapkit.protocols.misc.pcapng.TLSKeyLabel` do, which buys two things
-    a plain :class:`enum.Enum` does not: the value survives
+    :class:`~pcapkit.protocols.application.httpv1.Type` does, which buys two
+    things a plain :class:`enum.Enum` does not: the value survives
     :func:`json.dumps` -- a plain enumeration raises :exc:`TypeError` there, and
     :meth:`Datagram.to_dict <pcapkit.corekit.infoclass.Info.to_dict>` hands this
     field straight out -- and ``datagram.completed == 'timeout'`` works, so the
     new state can be tested for without importing this class.
+    :class:`~pcapkit.protocols.misc.pcapng.TLSKeyLabel` used to be a third
+    precedent for the same :class:`~pcapkit.utilities.compat.StrEnum` base, but
+    GitHub issue #886 moved its canonical definition to
+    :class:`pcapkit.const.pcapng.tls_key_label.TLSKeyLabel`, generated like its
+    :mod:`pcapkit.const.pcapng` siblings: it now derives from :class:`aenum`'s
+    own ``StrEnum`` (via :class:`~pcapkit.corekit.enum.EnumRegistry`) rather than
+    from :mod:`pcapkit.utilities.compat`'s version-branched one. Both
+    properties above still hold for it either way -- ``aenum.StrEnum`` is a
+    :class:`str` subclass same as the stdlib one -- but ``isinstance``/
+    ``issubclass`` against :class:`pcapkit.utilities.compat.StrEnum` no longer
+    does, which is why it is called out here rather than left silently stale.
 
     Warning:
         Being a :class:`str` whose :attr:`PARTIAL` and :attr:`TIMEOUT` members are

diff --git a/pcapkit/protocols/misc/pcapng.py b/pcapkit/protocols/misc/pcapng.py
@@ -35,6 +35,7 @@
 from pcapkit.const.pcapng.option_type import OptionType as Enum_OptionType
 from pcapkit.const.pcapng.record_type import RecordType as Enum_RecordType
 from pcapkit.const.pcapng.secrets_type import SecretsType as Enum_SecretsType
+from pcapkit.const.pcapng.tls_key_label import TLSKeyLabel as Enum_TLSKeyLabel
 from pcapkit.const.pcapng.verdict_type import VerdictType as Enum_VerdictType
 from pcapkit.const.reg.linktype import LinkType as Enum_LinkType
 from pcapkit.corekit.module import ModuleDescriptor
@@ -270,26 +271,27 @@ class PacketReception(enum.IntEnum):
     PROMISCUOUS = 0b100
 
 
-class TLSKeyLabel(StrEnum):
-    """TLS key log label, c.f., :rfc:`9850`."""
-
-    #: NSS-historical: not a registered label of :rfc:`9850#section-4.2`'s "TLS
-    #: SSLKEYLOGFILE Labels" registry. Defined by the Mozilla NSS
-    #: ``SSLKEYLOGFILE`` convention and removed in NSS 3.34; kept here only so
-    #: that key logs predating :rfc:`9850` still read.
-    RSA = 'RSA'
-    CLIENT_RANDOM = 'CLIENT_RANDOM'
-    CLIENT_EARLY_TRAFFIC_SECRET = 'CLIENT_EARLY_TRAFFIC_SECRET'  # nosec B105
-    CLIENT_HANDSHAKE_TRAFFIC_SECRET = 'CLIENT_HANDSHAKE_TRAFFIC_SECRET'  # nosec B105
-    SERVER_HANDSHAKE_TRAFFIC_SECRET = 'SERVER_HANDSHAKE_TRAFFIC_SECRET'  # nosec B105
-    CLIENT_TRAFFIC_SECRET_0 = 'CLIENT_TRAFFIC_SECRET_0'  # nosec B105
-    SERVER_TRAFFIC_SECRET_0 = 'SERVER_TRAFFIC_SECRET_0'  # nosec B105
-    EARLY_EXPORTER_SECRET = 'EARLY_EXPORTER_SECRET'  # nosec B105
-    EXPORTER_SECRET = 'EXPORTER_SECRET'  # nosec B105
-    #: HPKE KEM shared secret used in the ECH, c.f., :rfc:`9850#section-4.2`.
-    ECH_SECRET = 'ECH_SECRET'  # nosec B105
-    #: ECHConfig used for construction of the ECH, c.f., :rfc:`9850#section-4.2`.
-    ECH_CONFIG = 'ECH_CONFIG'
+# NOTE: TLSKeyLabel used to be hand-written here. GitHub issue #886: RFC 9850
+# :rfc:`9850#section-4.2` makes its values an IANA registry ("TLS
+# SSLKEYLOGFILE Labels", Specification Required) rather than a closed,
+# hand-picked helper enum, so it moved to
+# :class:`pcapkit.const.pcapng.tls_key_label.TLSKeyLabel`, generated the same
+# way as its :mod:`pcapkit.const.pcapng` siblings -- imported above as
+# ``Enum_TLSKeyLabel``, matching the ``Enum_*`` alias every one of its seven
+# :mod:`pcapkit.const.pcapng` siblings already carries in this file (the
+# owner's review on #890: this import was the only one of the eight lacking
+# it, because the class used to be *defined* here rather than imported, so
+# nothing applied the convention until this move made it an import). The
+# assignment below re-exports the same object under the module's own,
+# unaliased name, so ``from pcapkit.protocols.misc.pcapng import
+# TLSKeyLabel`` keeps working and still resolves to the identical class --
+# not a copy -- that every internal ``Enum_TLSKeyLabel`` reference below uses.
+# :class:`WireGuardKeyLabel` below stays hand-written -- it is verified closed
+# (draft-ietf-opsawg-pcapng-06 section 4.7's "is one of" four names) and not a
+# registry, so filing it under :mod:`pcapkit.const` would misrepresent it as
+# one; the ``Enum_*`` alias convention is about imports of const enums, and
+# this is a local definition, so it does not apply here.
+TLSKeyLabel = Enum_TLSKeyLabel
 
 
 class WireGuardKeyLabel(StrEnum):
@@ -5753,7 +5755,7 @@ def _make_secrets_unknown(self, type: 'Enum_SecretsType', secrets: 'Optional[Dat
         )
 
     def _make_secrets_tls(self, type: 'Enum_SecretsType', secrets: 'Optional[Data_TLSKeyLog]' = None, *,
-                          entries: 'Optional[dict[TLSKeyLabel, OrderedMultiDict[bytes, bytes]]]' = None,
+                          entries: 'Optional[dict[Enum_TLSKeyLabel, OrderedMultiDict[bytes, bytes]]]' = None,
                           **kwargs: 'Any') -> 'Schema_TLSKeyLog':
         """Make PCAP-NG TLS Key Log secrets.
 

diff --git a/pcapkit/vendor/__init__.py b/pcapkit/vendor/__init__.py
@@ -109,5 +109,5 @@
     # PCAPNG
     'PCAPNG_BlockType', 'PCAPNG_OptionType', 'PCAPNG_HashAlgorithm',
     'PCAPNG_VerdictType', 'PCAPNG_RecordType', 'PCAPNG_SecretsType',
-    'PCAPNG_FilterType',
+    'PCAPNG_FilterType', 'PCAPNG_TLSKeyLabel',
 ]
diff --git a/pcapkit/vendor/pcapng/__init__.py b/pcapkit/vendor/pcapng/__init__.py
@@ -25,6 +25,8 @@
      - Secrets Types [*]_
    * - :class:`PCAPNG_FilterType <pcapkit.vendor.pcapng.filter_type.FilterType>`
      - Filter Types [*]_
+   * - :class:`PCAPNG_TLSKeyLabel <pcapkit.vendor.pcapng.tls_key_label.TLSKeyLabel>`
+     - TLS Key Log Labels [*]_
 
 .. [*] https://www.ietf.org/archive/id/draft-tuexen-opsawg-pcapng-03.html#name-standardized-block-type-cod
 .. [*] https://www.ietf.org/archive/id/draft-tuexen-opsawg-pcapng-03.html#name-options
@@ -33,6 +35,7 @@
 .. [*] https://www.ietf.org/archive/id/draft-tuexen-opsawg-pcapng-03.html#name-name-resolution-block
 .. [*] https://www.ietf.org/archive/id/draft-tuexen-opsawg-pcapng-03.html#name-decryption-secrets-block
 .. [*] https://www.ietf.org/archive/id/draft-tuexen-opsawg-pcapng-03.html#name-interface-description-block
+.. [*] https://www.iana.org/assignments/tls-parameters/tls-sslkeylogfile-labels.csv, c.f., :rfc:`9850#section-4.2`
 
 """
 
@@ -42,10 +45,11 @@
 from pcapkit.vendor.pcapng.option_type import OptionType as PCAPNG_OptionType
 from pcapkit.vendor.pcapng.record_type import RecordType as PCAPNG_RecordType
 from pcapkit.vendor.pcapng.secrets_type import SecretsType as PCAPNG_SecretsType
+from pcapkit.vendor.pcapng.tls_key_label import TLSKeyLabel as PCAPNG_TLSKeyLabel
 from pcapkit.vendor.pcapng.verdict_type import VerdictType as PCAPNG_VerdictType
 
 __all__ = [
     'PCAPNG_BlockType', 'PCAPNG_OptionType', 'PCAPNG_HashAlgorithm',
     'PCAPNG_VerdictType', 'PCAPNG_RecordType', 'PCAPNG_SecretsType',
-    'PCAPNG_FilterType',
+    'PCAPNG_FilterType', 'PCAPNG_TLSKeyLabel',
 ]