TLS 1.3 & Secure Communication

🔥 Vibe Prompt

"Create a TLS 1.3 server and client using Python. Compare TLS 1.2 vs 1.3 handshake round trips."

import ssl, socket, threading, time

# Server
context_srv = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
context_srv.load_cert_chain(certfile="server.crt", keyfile="server.key")
context_srv.minimum_version = ssl.TLSVersion.TLSv1_3

def server():
    with socket.socket() as sock:
        sock.bind(('localhost', 8443))
        sock.listen(1)
        with context_srv.wrap_socket(sock, server_side=True) as ssock:
            conn, addr = ssock.accept()
            print(f"Server: connected from {addr}")
            print(f"Server: cipher={conn.cipher()}, version={conn.version()}")
            data = conn.recv(1024)
            conn.send(b"Hello from TLS 1.3 server!")

# Client
context_cli = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
context_cli.load_verify_locations(cafile="root-ca.crt")

def client():
    time.sleep(0.1)
    with socket.create_connection(('localhost', 8443)) as sock:
        with context_cli.wrap_socket(sock, server_hostname="api.vibetutor.com") as ssock:
            print(f"Client: cipher={ssock.cipher()}, version={ssock.version()}")
            ssock.send(b"Hello!")
            print(f"Client received: {ssock.recv(1024)}")

threading.Thread(target=server).start()
threading.Thread(target=client).start()
time.sleep(0.5)

TLS 1.3 Improvements

| Feature | TLS 1.2 | TLS 1.3 | |---------|---------|---------| | Handshake | 2 RTT | 1 RTT (0-RTT resumption) | | Ciphers | Many (some weak) | AEAD only (GCM/ChaCha) | | Session Tickets | Required | Resumption PSK |

Cryptography Course Complete! 🎉

✅ AES
✅ RSA
✅ Hash/HMAC
✅ PKI
✅ TLS 1.3

Chapter Summary

Understand core concepts and principles
Master implementation methods and techniques
Familiar with common issues and solutions
Able to apply in real projects

Implementation Example

Basic Example

# This section provides a complete implementation example

Steps

Setup: Configure development environment
Data: Prepare required data
Implementation: Build core functionality
Testing: Verify correctness
Optimization: Improve performance

Common Errors

| Error Type | Cause | Solution | |------------|-------|----------| | Compilation | Syntax | Check code syntax | | Runtime | Environment | Verify dependencies installed | | Logic | Algorithm | Step-by-step debugging | | Performance | Efficiency | Use profilers |

Code Example

import sys

def main():
    print("Hello, World!")

if __name__ == "__main__":
    main()

References

Official documentation
API reference
Open source examples
Community discussions

TLS 1.3 Handshake (2 RTT → 1 RTT)

TLS 1.3 reduces the handshake from 2 round trips to 1, dramatically improving connection speed.

TLS 1.2 Handshake (2 Round Trips)

Client → Server: ClientHello (supported ciphers)
Server → Client: ServerHello + Certificate + ServerHelloDone
Client → Server: ClientKeyExchange + ChangeCipherSpec + Finished
Server → Client: ChangeCipherSpec + Finished

TLS 1.3 Handshake (1 Round Trip)

Client → Server: ClientHello (key share + supported ciphers)
Server → Client: ServerHello (key share + certificate + finished)
Client → Server: Finished

0-RTT (Early Data)

TLS 1.3 optionally supports 0-RTT — send data immediately on resumption.

| Feature | TLS 1.2 | TLS 1.3 | |---------|---------|---------| | Handshake RTT | 2 | 1 | | 0-RTT support | ❌ | ✅ (optional) | | Cipher suites | Many (including insecure) | Few (all secure) | | Remove insecure ciphers | ❌ RC4, DES, 3DES | ✅ None | | Remove static RSA | ❌ | ✅ Ephemeral only | | Remove compression | ❌ | ✅ | | Remove renegotiation | ❌ | ✅ |

Cipher Suites in TLS 1.3

TLS 1.3 uses only five cipher suites, all authenticated encryption.

| Cipher Suite | Key Exchange | AEAD | |--------------|--------------|------| | TLS_AES_128_GCM_SHA256 | ECDHE | AES-128-GCM | | TLS_AES_256_GCM_SHA384 | ECDHE | AES-256-GCM | | TLS_CHACHA20_POLY1305_SHA256 | ECDHE | ChaCha20-Poly1305 | | TLS_AES_128_CCM_SHA256 | ECDHE | AES-128-CCM | | TLS_AES_128_CCM_8_SHA256 | ECDHE | AES-128-CCM-8 |

Recommended Configuration

# Nginx TLS 1.3 configuration
server {
    listen 443 ssl http2;
    server_name example.com;
    
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256;
    
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    
    # HSTS (HTTP Strict Transport Security)
    add_header Strict-Transport-Security "max-age=63072000" always;
}

Perfect Forward Secrecy

TLS 1.3 mandates ephemeral Diffie-Hellman key exchange — previous sessions cannot be decrypted even if the private key is compromised.

# PFS: Each session generates unique session keys
# Compromising the server's long-term key cannot decrypt past sessions

# TLS 1.2 (no PFS — static RSA)
# Server sends RSA public key in cert
# Client encrypts premaster secret with RSA public key
# Attacker with private key → decrypts ALL past sessions

# TLS 1.3 (with PFS — ECDHE)
# Both sides generate ephemeral key pairs
# Session keys derived from ephemeral exchange
# Attacker with long-term key → CANNOT decrypt past sessions

Certificate Validation in TLS

import ssl
import socket

def verify_tls_connection(hostname: str, port: int = 443):
    """Verify TLS connection and certificate chain."""
    context = ssl.create_default_context()
    
    try:
        with socket.create_connection((hostname, port), timeout=5) as sock:
            with context.wrap_socket(sock, server_hostname=hostname) as ssock:
                cert = ssock.getpeercert()
                
                return {
                    "verified": True,
                    "tls_version": ssock.version(),
                    "cipher": ssock.cipher(),
                    "cert_subject": dict(x[0] for x in cert['subject']),
                    "cert_issuer": dict(x[0] for x in cert['issuer']),
                    "cert_expiry": cert['notAfter']
                }
    except ssl.SSLError as e:
        return {"verified": False, "error": str(e)}
    except Exception as e:
        return {"verified": False, "error": f"Connection failed: {e}"}

# Check google.com TLS
result = verify_tls_connection("google.com")
for key, value in result.items():
    print(f"{key}: {value}")

Testing TLS Configuration

# Check TLS version and ciphers supported
nmap --script ssl-enum-ciphers -p 443 example.com

# Using openssl
echo | openssl s_client -connect example.com:443 -tls1_3 2>/dev/null | grep "New, TLS"

# Using testssl.sh
git clone https://github.com/drwetter/testssl.sh.git
./testssl.sh/testssl.sh example.com

Summary

TLS 1.3 is the latest encryption protocol securing internet traffic. It offers faster handshakes, stronger cipher suites, perfect forward secrecy, and 0-RTT resumption.

Key takeaways:

TLS 1.3: 1-RTT handshake (vs 2-RTT in TLS 1.2) |
0-RTT resumption sends data immediately on reconnect |
Only 5 cipher suites — all AEAD, no weak algorithms |
Perfect Forward Secrecy mandated — ephemeral key exchange |
Removed: static RSA, compression, renegotiation |
HSTS header enforces HTTPS-only connections |
Validate TLS with nmap, openssl, or testssl.sh |
TLS 1.3 works with existing certificate infrastructure |

You've completed this course! You now understand encryption, hashing, PKI, and TLS.