What's New in TLS 1.3
summary
TLS 1.3 tightens choices and cuts latency: it replaces dozens of legacy suites with five cipher choices (AES-GCM/CCM and ChaCha20-Poly1305), mandates AEAD, and fixes nonces by using fixed nonce XOR sequence number to avoid GCM/CTR nonce reuse. Handshake drops from 2RTT to 1RTT and supports 0-RTT early data for resumption, but that early data is not forward secure and is replayable unless mitigated. Resumption uses encrypted session tickets (session tickets encrypted by server key), so rotate ticket keys and require ephemeral DH on resume for forward secrecy.
AI-written summary · about
chapters (18)
- 0:00Intro
- 0:47nccgroup
- 2:28Security Properties We Want
- 5:19Ciphersuite Choices
- 11:06GCM Mode
- 13:10TLS 1.3 Nonces
- 13:50TLS 1.3 Ciphersuites
- 15:52Key Exchange Modes?
- 17:43TLS 1.2 DHE
- 19:46TLS 1.3 Handshake
- 26:01TLS 1.3 Resumption
- 27:55Key Schedule: Resumption
- 31:33Resumption Takeaways
- 34:23Key Schedule: ORTT
- 35:26Forward Secrecy
- 38:44ORTT Takeaways
- 40:27Summing It Up
- 40:57Questions?
related talks
14mJust the Cryptography You Need to Know for TLS
22mTLS 1.3: what developers should know about the API
19mWhat's happening in TLS (transport layer security)?
53mHansel and Gretel do TLS
44mEfficient Forward Security for TLS 1.3 0-RTT
37mTransport Layer Security (TLS) v1.3 support in Java
45mUnlocking The Secrets Of TLS
51mEverything you learned about SSL is deprecated