TLS 1.3 Cryptography

Transport Layer Security (TLS) 1.3 (RFC 8446) marks the most significant overhaul to web encryption since SSL 3.0, prioritizing performance by slashing round trips.

The 1-RTT Breakthrough

TLS 1.2 required two full round trips to establish a secure connection. The client had to negotiate the cipher suite first, then perform the key exchange. TLS 1.3 radically simplified this.

By removing obsolete, insecure cipher suites (like RSA key exchange and weak elliptic curves) and strictly enforcing Diffie-Hellman Ephemeral (DHE), the client can confidently "guess" the key agreement protocol. The client sends its key share in the very first ClientHello message.

Client                                               Server

ClientHello
 + key_share               -------->
                                                ServerHello
                                                + key_share
                                      {EncryptedExtensions}
                                      {CertificateRequest*}
                                             {Certificate*}
                                       {CertificateVerify*}
                                                 {Finished}
                           <--------  [Application Data*]
{Certificate*}
{CertificateVerify*}
{Finished}                 -------->
[Application Data]         <------->  [Application Data]

0-RTT Resumption

If a client has previously connected to a server, TLS 1.3 allows for 0-RTT (Zero Round Trip Time) resumption. Using pre-shared keys (PSK) derived from the previous session, the client sends encrypted HTTP request data along with its very first TLS packet.

Warning: 0-RTT data is susceptible to replay attacks. Architectures must ensure that 0-RTT requests are idempotent (e.g., HTTP GET requests) to prevent malicious actors from capturing and re-sending state-mutating requests.