A Cryptographic Analysis of the TLS 1.3 Handshake Protocol

Abstract We analyze the handshake protocol of Transport Layer Security (TLS) protocol, version 1.3. address both full TLS 1.3 (the one round-trip time mode, with signatures for authentication and (elliptic curve) Diffie–Hellman ephemeral ((EC)DHE) key exchange), abbreviated resumption/“PSK” mode which uses a pre-shared (with optional (EC)DHE exchange zero establishment). Our analysis in reductionist security framework multi-stage model, where each many session keys derived single is tagged various properties (such as unauthenticated versus unilaterally authenticated mutually authenticated, whether it intended to provide forward security, how used protected against replay attacks). show that these modes establish their desired under standard cryptographic assumptions.