I am working on an investigation on TLS 1.3. I've came across an article of qacafe where they shared a TLS 1.3 handshake sequence. Wireshark capture. In this capture you see that in the Client Hello a key_share is being send where it is "guessing" which cypher suite to use. This saves some bytes. by not having to send the whole list. However I don't see any certificate exchange in this capture.

Does someone know why the certificate exchange is missing here? An reason could be the pre_shared_key method of TLS 1.3, however I don't see that extension being used in the Client Hello. Does someone have an explanation for this?

  • 1
    $\begingroup$ That's simple, the certificate exchange is performed after key establishment. However, TLS 1.3 has been designed in such a way that packets are encrypted as soon as the master secret and the session keys have been calculated. This includes the header packets. You'll need the master secret to be able to decrypt the header packets. Alternatively you can obtain them using a client that is able to dump the certificate chain send by the server (such as sclient). $\endgroup$
    – Maarten Bodewes
    Aug 15, 2023 at 18:20
  • $\begingroup$ Certificate specific questions are often better asked on Information Security or Super User. Please be aware that it is very likely that this question has been asked before. $\endgroup$
    – Maarten Bodewes
    Aug 15, 2023 at 18:21
  • 1
    $\begingroup$ tls13.xargs.org is an excellent explanation of every step in a TLS 1.3 connection. Observe that the Server Certificate is sent after encryption starts, with a temporary symmetric key. After the Application Keys Calc step(s), the symmetric key for encrypting the remaining messages has been calculated and gets used. $\endgroup$ Aug 15, 2023 at 19:00


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.