The TCP connection is up, but the bytes flowing over it are still plaintext. TLS 1.3's job is to turn that pipe into an encrypted channel — and its headline achievement is doing it in exactly one round trip: the client's first flight and the server's response together complete key agreement and authentication. Here is the trace.
The client — OpenSSL, BoringSSL, or the OS's TLS stack — builds a ClientHello record: protocol version, supported cipher suites, and — critically, in TLS 1.3 — an X25519 public key share generated locally in microseconds. It also sends SNI so the server can pick the right certificate. This record goes out with the very first application bytes on the fresh connection.
The server picks the shared cipher suite, generates its own X25519 key pair, and replies with ServerHello carrying its key share, plus its certificate chain (leaf + intermediates, typically 2–4 KB) and a Finished message. The client now performs the ECDH: multiplying its private key by the server's public key yields a shared secret that no passive observer can derive.
Both sides run the key schedule — HKDF over the ECDHE secret plus transcript hashes — producing separate traffic keys for each direction. The Finished messages authenticate the entire transcript, so any tampering with either flight fails the hash. At this point the client's application data can be sent encrypted: 1 RTT after ClientHello, and the very same flight can carry the HTTP request.
Record layer: every application byte is now AEAD-encrypted (AES-128-GCM or ChaCha20-Poly1305, ~1–2 GB/s with AES-NI on modern x86) with a sequence-numbered nonce. The handshake is over; the remaining cost is pure throughput.
Repeat connections skip most of this. If the client presents a previously issued PSK (session ticket), the server completes a psk_ke handshake with zero ECDHE — 0-RTT if the client also sends early data. The price: 0-RTT data is replayable, so it is only safe for idempotent requests.
openssl s_client -connect example.com:443 -tls1_3 -sess_out /tmp/sess < /dev/null
openssl s_client -connect example.com:443 -tls1_3 -sess_in /tmp/sess < /dev/null # second run: PSK, no ECDHEWhat the machine actually does is a carefully ordered dance of public-key math (microseconds, CPU) around a fixed number of round trips (milliseconds, network). The cryptography is nearly free; the RTTs are everything.