<aside> 🧭

Module 06 · The TLS Handshake, 1.2 vs 1.3

You have a key, a certificate, a chain and a CA. This module is about the twenty milliseconds in which all of it gets used. You will watch a real handshake message by message in both TLS 1.2 and 1.3, see exactly what 1.3 removed and why, and understand the hybrid post-quantum key exchange that now carries two thirds of browser traffic.

🧠 concept → 🧪 exercise → ✅ expected result (hidden) → 🎯 interview questions (answers hidden)

Prerequisite: Modules 01–05. You need symmetric/asymmetric crypto and hybrid encryption from Module 01 (Part B), the certificate fields from Module 03, and the chain from Module 05.

</aside>

<aside> 🤝

The picture to hold in your head for this whole module — two strangers meeting in a corridor.

They have never met, anyone might be listening, and in under a second they must agree on three things:

1. Which language shall we speak? — protocol version and cipher suite
2. Who are you? — the certificate and its proof
3. What is our shared secret? — the key that encrypts everything after

And the hard part: step 3 has to happen in the open, where the eavesdropper hears every word, and they must still end up with a secret the eavesdropper does not have.

That sounds impossible. Module 01 (Part B2) already showed you why it is not.

</aside>

<aside> 🖥️

Set up before you start. You will use the CA and server certificate you built in Module 05.

mkdir -p ~/tls-lab/m06 && cd ~/tls-lab/m05     # we reuse Module 05's lab
umask 077
openssl version

# start a local TLS server in the background
nohup openssl s_server -cert app.crt -cert_chain int/int.crt -key app.key \
      -accept 4433 -www > /tmp/tls-srv.log 2>&1 &
sleep 1

Running your own server matters here. Against a real site you would be watching a handshake you cannot control; locally you can force versions, break things, and see the difference.

Stop it later with kill %1, or pgrep -f 'accept 4433' | xargs kill.

All expected output was produced on OpenSSL 3.0.13.

</aside>

Part A · What a handshake is actually for

A1 · Three jobs, in order

<aside> 📖

Official docs: RFC 8446 — TLS 1.3 · RFC 8446 §2 — Protocol Overview · openssl s_client manual

</aside>

<aside> 🚪

The analogy — arriving at a stranger's front door.

Three things happen before you are let in, always in this order:

1. You find a common language. No point continuing if you speak French and they speak Japanese.
2. They prove who they are. They hold up ID through the window — you check it before you hand anything over.
3. You agree a private way to talk. Only now, once you know who they are, is it worth establishing a secret.

Getting the order wrong ruins it. Agree a secret before checking the ID and you have established a private channel with a stranger — which, as Module 01 (Part C1) showed, is exactly the man-in-the-middle situation.

</aside>

<aside> 🔑

The one sentence to carry through this whole module: the certificate does not encrypt anything.

In Module 01 you learned the armoured-van analogy — asymmetric crypto is slow, so you use it once and switch to symmetric. It is easy to conclude the certificate's key is used to encrypt the session key.

In TLS 1.3 that is never true, and in modern TLS 1.2 it is almost never true. The certificate's key is used only to sign, proving possession. The actual key agreement is a separate Diffie-Hellman exchange that the certificate takes no part in.

Why that matters: it is the reason stealing a server's private key does not let an attacker decrypt yesterday's traffic. That property is called forward secrecy, and it is the single biggest thing TLS 1.3 made non-optional.

</aside>

🧪 Exercise A1.1 — Look at what a handshake negotiated

cd ~/tls-lab/m05
openssl s_client -connect 127.0.0.1:4433 -servername app.internal.test \
  -CAfile root/root.crt </dev/null 2>/dev/null \
  | grep -E 'Protocol *:|Cipher *:|Server Temp Key|Peer signature|Verify return code'

• ✅ Expected result — click to reveal

🎯 Interview questions — What a handshake does

• Q. Describe the process of a TLS handshake.

Part B · TLS 1.3, message by message

B1 · The flow