TLS 1.3 Handshake - many CHANGES from prior versions!

The TLS 1.3 Handshake changes significantly from the TLS 1.2 (and prior) handshake. In this video we discuss 4 major changes to the TLS handshake with the latest version:

- TLS 1.3 Handshake is shorter, only one round trip (1RTT)
- TLS 1.3 Handshake is mostly encrypted (everything except the Client Hello and the Server Hello)
- TLS 1.3 Handshake encrypts the Client Certificate (as well as the Server Certificate)
- TLS 1.3 Handshake generates many more session keys

👉 This is a sample lesson from my SSL & TLS deep dive course: Practical TLS.

🔑 More free lessons from the course:

🏢 Do you configure or troubleshoot TLS/SSL for work? If so, I'm willing to bet your employer would happily pay for this SSL training. Reach out if you'd like to coordinate an introduction for a bulk license purchase with your company. If your referral leads to live training engagement, I'll buy you an iPad (or tablet of similar value of your choice)

💬 Join Practical Networking Discord

00:00 - Review of TLS 1.2 (and prior) TLS Handshake
01:15 - Comparing TLS 1.3 Handshake and TLS 1.2 Handshake
02:46 - TLS 1.3 One Round Trip Handshake (1RTT) simply explained
05:48 - TLS 1.3 0RTT - Zero Round Trip Handshake
06:58 - TLS 1.3 encrypts most of the TLS Handshake
07:37 - ESNI, Encrypted SNI, Encrypted Server Name Indication
08:53 - ECH, Encrypted Client Hello
10:30 - TLS 1.3 encrypts the Client Certificate in Mutual TLS (MTLS)
12:42 - TLS 1.3 generates many more session keys
16:12 - Key Points - TLS 1.3 Changes to the TLS Handshake
16:45 - Want more? Check out Practical TLS - the *BEST* TLS training course ever created
#ssl #tls #cybersecurity

[PracticalNetworking]

📢 *Holiday & New Year Promotion*
👉 Practical TLS for only $55 _(originally $297)_
💻 Use code *FROM2024TO2025* --> pracnet.net/tls
📅 Offer expires Jan 4

[dragonbg]

You never disappoint. Im rarely as excited for watching a technical video as when I watch yours. Thank you!

[NitroBlaziken]

Perfect way to end off this mini series! Very well explained easily digestible information that informs the viewer exactly what did change in TLS 1.3 and why it's important to learn it.

[zacharykosove]

9:42 is really interesting, does anyone know where I can find any active discussions about this idea and how it COULD be implimented

[sreekumarj]

Awesome video. Excited for the give away. Love your courses

[muralikrishna-froh]

Nice explanation, can we expect anything on IPSec?

[vFoxArts]

Thank you Ed, exciting to see how long TLS 1.3 will evolve.
Are you also going to release the TLS 1.3 session renegotiation part? :)

[TGUK]

Great video, doesn't the quic protcol also reduce the round trip?

[safwanumer]

Any update on TLS 1.3 Key schedule course?

[greob]

I was not aware of these difference, very instructive!

[alexanderjansen]

Hey Eddie, awesome video. Can you make one where you explain DTLS and its difference to TLS please?

[talesara]

TLS 1.3 client hello is with many other information like all guessed cipher suites key shares. Are you going to cover that in a new video?

[vlgermanov]

Thanks for the video. As usual great and understandable explanation of the topics!

[AlexeyTsapaev]

I guess we can encrypt the hello message with the server public key stored in certificate but we should be able to fetch it prior somehow

[HoeSanBay]

Hi, thanks for your sharing. In TLS 1.2 handshake, the "gray glomy text" "Finished" is encrypted or decrypted? For advice. Thanks.

[HoeSanBay]

Hi, in TLS 1.3 handshake, the "gray glomy text" "Finished" below the purple line is encrypted or decrypted? Thanks.

[chittlingwhittles]

Sir can you please make full video series of how to tell ma’am NOT to redeem?

[BernhardHustomo]

question: actually what port the TLS is using, i am kinda hv chicken and egg problem with HTTP/HTTPS and the TLS that encrypts the HTTP itself.. but u mentioned that not only HTTP is protected by TLS.. how about something like RADIUS when we are doing EAP-TLS or even the EAP-PEAP.. they still need to establish the TLS tunnel, but as per my understanding it is between client and the server, it does not protect the RADIUS protocol..

[padderhilal]

Sir, make vedios on data flow via cache, Ram, rom and secondary memory. And also via registers.