The Runtime Theory

TLS 1.3 Handshake Flow: ClientHello, Key Exchange, and Finished in One Round Trip

Step through the TLS 1.3 handshake — ClientHello with key shares, ServerHello, certificate verification, Finished, and PSK-based session resumption.

The Runtime Theory Team08 stages

trace / request.md

CLIENTHELLOWITH KEY_SHARESERVERHELLOPICKS CIPHERSERVER FLIGHT,ENCRYPTEDCLIENTVERIFIES CHAINCLIENT FINISHEDENCRYPTEDAPP DATAPSK RESUMPTIONORDERLY CLOSE

readyThe client sends its supported cipher suites, a random nonce, and an ephemeral public key (key_share, usually X25519). Nothing is secret yet — everything in this flight is plaintext.

The handshake is designed around a single insight: the client can guess the server's key-exchange choice, so TLS 1.3 lets it send a key share in the first flight. The client's ClientHello carries an X25519 public key; the server picks a cipher and answers with its own share, and both sides derive a handshake secret before any certificate is even sent.

From the ServerHello onward, every message is encrypted — the certificate, the signature proving the server owns that certificate, and the Finished MACs that authenticate the entire transcript. Verification happens client-side against the trust store, and the application traffic keys are derived only after both Finished messages. The ordering is load-bearing: keys are derived from transcript hashes, so any tampering or replay changes the Finished and fails the handshake. Resumption trades the one-RTT setup for a PSK exchange that cuts it to zero when the server permits early data.