6.6 TLS version 1.3

In the years since its inception, TLS and its predecessor, SSL, have suffered a lot of attacks, both at the protocol level and the algorithm level (we will be discussing a few of them in Part IV, Bleeding Hearts and Biting Poodles). Step by step, these attacks have been mitigated in new TLS versions and extensions up to version 1.2. However, due to the need for backward compatibility and the resulting possibility for version rollback attacks, each new TLS version inherited the weaknesses of its predecessors. For example, the cumulative number of cipher suites in all TLS versions up to version 1.2 is 319, including a large number of outdated and insecure algorithms.

Figure 6.6: Overview of TLS session resumption (up to V1.2, adapted from [146])

Therefore, in 2018, it was time for a larger clean-up: unsafe or unused options were removed in version 1.3, and version downgrade attempts are signaled to the client by the last eight bytes of Server˙...