7.10 Public-key cryptography in TLS 1.3

Equipped with the mathematical background on public-key cryptography, we can now explore how it is applied in TLS 1.3.

In the previous chapter, we learned that client Bob and server Alice exchange messages during the TLS handshake phase to establish all parameters necessary for deriving the TLS secrets and, subsequently, the TLS keys.

Technically, these cryptographic parameters are transmitted in the key˙share extension of the ClientHello, ServerHello and, if needed, HelloRetryRequest messages.

7.10.1 Client key shares and server key shares

In a ClientHello message, the key˙share extension – more precisely, its extension˙data field – contains a value called KeyShareClientHello defined as follows:

struct {
    KeyShareEntry client_shares<0..2^16-1>;
} KeyShareClientHello;

The client˙shares variable is a list of key shares offered by client Bob to server Alice in the initial ClientHello...