13.2 TLS server state machine
The server state machine is shown in Figure 13.2. Like with the client state machine, labels in square brackets indicate actions that the server performs only under specific circumstances.
Figure 13.2: State machine and state transitions of a TLS 1.3 server
For server Alice, the TLS handshake is triggered by receiving the ClientHello message from client Bob. Upon receiving this message, Alice transitions to the state RECVD˙CH, denoted by RCH in Figure 13.2.
If Bob’s message contains parameters that Alice does not support, she replies with a HelloRetryRequest and switches into the initial state S.
Otherwise, Alice selects desired parameters from those offered by Bob in his ClientHello and replies with the ServerHello message. In addition, Alice sends EncryptedExtensions, encrypted with the handshake key.
Alice also sends the CertificateRequest message if she wants Bob to authenticate himself using his certificate. Moreover,...
