Skip to content
hashkey.bond

Archivetls

TLS 1.3 in One Round Trip

What was removed from TLS 1.2 matters as much as what was added: fewer options, fewer downgrade paths.

Published
Reading time
1 min read

TLS 1.3 completes a full handshake in one round trip (1-RTT) and supports 0-RTT resumption. It got there by deleting negotiating surface, not by optimizing the old flow.

The flow

  1. Client sends ClientHello with key shares (usually X25519), supported cipher suites, and signature algorithms.
  2. Server picks a suite, sends its key share, certificate, and Finished — all encrypted after the key is derived.
  3. Client verifies, sends its Finished; application data can follow immediately.

Key schedule: ECDHE shared secret → HKDF-Extract → handshake secrets → application secrets, each bound to a transcript hash.

What got removed

  • Static RSA and plain DH key exchange (no forward secrecy).
  • CBC mode and RC4.
  • Compression (CRIME).
  • Renegotiation.
  • Custom DHE groups.

What 0-RTT costs

Early data is replayable. Only send requests that are safe to repeat, and servers must reject it for state-changing operations.

Takeaway: TLS 1.3 security comes from a smaller protocol. If a deployment still offers TLS 1.0/1.1 or static RSA suites, the upgrade is a security fix, not a performance tune.