13.1 TLS client state machine
Appendix A of RFC 8446, the IETF specification of TLS 1.3, summarizes valid states and state transitions for TLS 1.3 server and client. The client state machine is shown in Figure 13.1. Labels in square brackets indicate actions the client performs only under specific circumstances. Label k = x indicates that the key k is set to value x.
Figure 13.1: State machine and state transitions of a TLS 1.3 client
Client Bob starts the TLS handshake by sending the ClientHello message to server Alice. If Bob and Alice have agreed upon a secret key in a previous TLS session, Bob may use this key to encrypt early data.
Bob then transitions into state WAIT˙SH, denoted by WSH, where he waits for the ServerHello message from Alice. If Bob’s ClientHello contains parameter values that Alice does not support, she replies with a HelloRetryRequest message, thereby making Bob switch back to the initial state and re-send ClientHello with different parameters...
