THE PROBLEM
Network traffic can be observed or altered unless endpoints establish encryption and authenticate who they are talking to.
THE NAIVE APPROACH
Encrypting with a secret key that was never safely agreed or checking no identity leaves serious gaps.
THE KEY INSIGHT
TLS 1.3 combines authenticated key exchange, transcript verification and symmetric traffic keys.
WHERE YOU MEET IT
- • HTTPS websites
- • Secure API connections
- • Encrypted mail transport
ANALOGY / HISTORY
Agreeing on a private language after checking the other party's identity.
Context: TLS 1.3 streamlined earlier TLS handshakes and removed obsolete cryptographic options.
client → server · CLIENT_HELLO
ClientHello
The client starts the handshake with supported versions, cipher suites, random bytes and key-share material. This is a structured handshake message carried in a TLS record (or inside QUIC for HTTP/3).
Seeing 0x0303 in a TLS 1.3 ClientHello does not mean the connection negotiated TLS 1.2.
The legacy record version and legacy_version fields are compatibility values in TLS 1.3. The supported_versions extension negotiates TLS 1.3.