17.6 Limits on key usage
TLS 1.3 specification defines cryptographic limits for the total amount of plaintext that can be securely encrypted using a given set of keys. Assuming that the underlying cryptographic primitives AES or ChaCha20 have no mathematical weaknesses – an assumption made by TLS 1.3 authors – up to 224.5 full-size records, that is, about 24 million records, can be securely encrypted using AES-GCM. In the case of ChaCha20/Poly1305, the TLS record sequence number would wrap before the cryptographic limit for this algorithm is reached.
