Networking & Protocols

TLS 1.3: free-recall review

Crux Free-recall prompts across the TLS 1.3 unit. Answer each in your own words first, then reveal the model answer and compare.

Your altitude — climbing toward senior

ZeroJuniorMiddleSenior

You are at senior altitude — in orbit

◷ 13 min

Retrieval beats re-reading. For each prompt, say or write a full answer from memory before you open the model answer — the effort of recall is what makes the mechanism stick.

Goal

Reconstruct the unit’s core mechanisms — the 1-RTT handshake, forward secrecy, the transcript hash, 0-RTT replay defenses, the HKDF key schedule, and SNI privacy — without looking back at the lessons.

Recall before you leave

01
Walk the TLS 1.3 cold handshake from ClientHello to first encrypted byte, and explain why it costs exactly one RTT.
02
Why does embedding an ephemeral ECDHE key_share in ClientHello give Perfect Forward Secrecy automatically?
03
What is the transcript hash and how does it make the handshake tamper-evident, including downgrade attempts?
04
PSK resumption and 0-RTT both reuse a cached secret. What is the security difference between them?
05
List the three orthogonal 0-RTT replay defenses production deployments layer together, and what each catches.
06
Why does TLS 1.3 run the ECDHE secret through an HKDF key schedule with domain-separated labels instead of using it directly, and why does SNI still need ECH?

Recap

If you could reconstruct each answer from memory, you hold the unit’s spine: the ECDHE key_share in ClientHello buys 1-RTT and PFS together; the transcript hash makes every negotiated parameter tamper-evident; PSK resumption trades fresh authentication for speed while staying replay-safe, but 0-RTT trades a round-trip for replay exposure that three layered defenses must contain; the HKDF key schedule isolates every key branch; and SNI still leaks the hostname until ECH encrypts it.

Continue the climb ↑TLS 1.3: trace and config reading