15.6 AEAD in TLS 1.3

In TLS version 1.3 – in contrast to previous TLS versions – all ciphers used to protect the payloads in the TLS Record protocol are AEAD ciphers. As discussed above, an AEAD algorithm takes the following data as input:

• A plaintext to be encrypted and authenticated

• A single shared secret key

• A nonce

• Additional data to be authenticated, but not encrypted

In TLS 1.3, either client˙write˙key or server˙write˙key is the shared secret key. Moreover, one of the two initializations vectors client˙write˙iv (supplied by the client) or server˙write˙iv (supplied by the server) and a sequence number are used for generating the nonce. Finally, the plaintext is stored in the TLSInnerPlaintext structure, and the additional data to be authenticated is in the record header:

additional_data = TLSCiphertext.opaque_type || TLSCiphertext.legacy_record_version || TLSCiphertext.length

The output of the AEAD algorithms consists...