TLS 1.3 handshake

TLS 1.3 handshake: 1 round trip to a shared secret, proven identity, encryption

The problem: agree a secret on an open wire, prove identity, then encrypt

Browser opens an HTTPS URL to a server it never met; the wire is readable by anyone Before the first page byte: a secret only they know, mutual proof of identity, encryption on TLS 1.3 finishes in one round trip, a deliberate simplification of chattier TLS 1.2 Three threads run interleaved and finish together: key agreement, authentication, encryption

Key agreement: ephemeral Diffie-Hellman makes a secret the wire never carries

ClientHello guesses ahead, sending cipher suites plus a fresh ephemeral key share per offered curve ServerHello picks one suite and one curve, returning the server's own ephemeral public share Each side mixes its private share with the other's public share, reaching the identical secret Ephemeral scalars are discarded after the connection, so a later-stolen long-term key cannot decrypt past traffic HKDF stretches the raw secret into a key schedule; from ServerHello on, traffic is encrypted

Authentication: the server signs the transcript to prove it owns its certificate

Certificate: an X.509 chain binds the server identity to a public key, signed by a CA the client trusts Owning a certificate is not proof, since certificates are public; the matching private key must be shown CertificateVerify: a signature over the transcript hash that only the private-key holder can produce Because it covers the running transcript, that signature also proves no message was tampered with The client checks the chain to a trusted root and verifies the signature, or aborts before any data

Integrity and 1-RTT: Finished MACs the transcript; client replies in one flight

Both sides send Finished, a MAC over the entire transcript keyed from the shared secret Any altered, dropped, or reordered message makes the transcripts differ, so the MACs mismatch and the link dies The client already derived keys from ServerHello, so it sends Finished and first data with no second trip

Faster and safer than TLS 1.2: legacy crypto removed, optional 0-RTT resumption

Static RSA key exchange, renegotiation, compression, and weak ciphers and hashes were all removed A returning client can send data in its first flight with a pre-shared key (0-RTT), risking small replay Net effect: fewer messages and knobs, with secrecy, identity, and integrity pinned to one ephemeral secret