Which key is used to encrypt certificate and certificate verify message in TLS1.3?

I could not figure out which one it is reading section 4.4.2 of RFC 8846 and I only saw a vague mention on page 11.

  • $\begingroup$ Actually its mentioned at multiple places but written very vaguely so there are very high chances that reader can miss it at first time. please check section 4.4, or grep for "[sender]_handshake_traffic_secret" where sender can be replaced by "server/client" based on who send the handshake packets. $\endgroup$ – rakesh sharma Apr 14 '19 at 19:57

Due to the design of TLS 1.3 and different to earlier TLS versions the normal (EC)DHE key exchange is already finished once the server sends the certificate. They key server_handshake_traffic_secret used to encrypt the certificate and other handshake messages is based on the same key material as the keys which are used for the application data later. For the exact details on which separate keys exist and how they are derived from the common key material see RFC 8446 section 7.1 Key Schedule.

| improve this answer | |
  • $\begingroup$ Thanks a lot, appreciate your help. $\endgroup$ – rakesh sharma Apr 13 '19 at 19:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.