TLS 1.3 Referenz
Referenz für TLS 1.3 (RFC 8446): handshake, Schlüssel schedule, 0-RTT, und Chiffre suites.
Handshake Improvements
TLS 1.3 reduces the handshake to 1-RTT (one round trip) from TLS 1.2's 2-RTT. 0-RTT data resumption sends application data in the first flight using cached PSK. The handshake is encrypted after the ClientHello, hiding extensions and certificates from passive observers. Key exchange uses only (EC)DHE or PSK; RSA key exchange is removed. All cipher suites are AEAD with forward secrecy. The protocol removes insecure features like compression and renegotiation.
- 1-RTT
- Faster handshake
- 0-RTT
- Resumption data
- encrypted
- Handshake privacy
vs 2-RTT in 1.2first flightafter ClientHelloKey Schedule and Security
The TLS 1.3 key schedule uses HKDF with a secret tree deriving separate keys for each direction and purpose. Forward secrecy is mandatory (DHE or ECDHE). PSK modes enable resumption without DHE but lose forward secrecy for the resumed session. Downgrade protection prevents forced fallback to TLS 1.2. Alert messages are encrypted (except a few). The record layer uses AEAD with sequence-number-derived nonces. Certificate Verify signs the transcript, binding authentication to the handshake.
- key schedule
- HKDF secret tree
- forward secrecy
- Mandatory DHE/ECDHE
- downgrade
- Protection mechanism
per-direction keysno RSA exchangesentinels in random