TLS 1.3 Cipher Suite

 

TLS1.3 is released in August 2018 (RFC8446).  It is a latest version of Transport Layer Protocol. It will remove a weaker algorithms and improve a speed of authentication. 

TLS 1.2 Cipher suit diagram:

TLS_DHE_RSA_WITH_AES_256_CBC_SHA

Key Exchange[DHE], Authentication [RSA], Encryption [AES_256_CBC] and Hashing [SHA]

TLS1.3 will support 5 Cipher suites compare to TLS.2 will support of multiple Cipher suites.

TLS1.3 including 5 Cipher Suites:

• TLS_AES_128_GCM_SHA256 [Must Implement]
• TLS_AES_256_GCM_SHA384 [Should be Implement]
• TLS_CHACHA2-_POLY305_SHA256 [Should be implement]
• TLS_AES_128_CCM_SHA256 [Can implement]
• TLS_AES_128_CCM_8_SHA256 [Can implement]

It will follow up with forward secrecy [Once Encrypted always encrypted]

TLS1.3 will remove a custom DH Groups and support a standard based group only, because it will lead may insecure groups being used and breach a security.

DH means Diffi-Hellman starts with agreeing upon some values.

Approved DH groups are designated via various standards.

* Traditional DH groups : RFC 2409 & RFC 3526

* Elliptic Curve Groups : RFC 5639, FIPS 186-4

Handshake method of TLS 1.2 Vs 1.3

TLS1.2 is using 2routing method for handshake a request, but TLS1.3 is using 1 routing method for handshake method. It will improve a quick response compare to TLS1.2.

TLS1.2 is created 4 keys while handshake connection.

• Client encryption
• Client HMAC
• Server Encryption
• Server HMAC

 TLS1.3 will create a 11 keys while handshakes connection request.

TLS workflow:

* TLS/SSL will send a highest support version of client Hello and Sever Hello for handshake.

Middlebox or Load balancer will drop a request if mismatch of version upto TLS1.2.

TLS1.3 will create a header with TLS1.0 , Client hello version with TLS 1.2 and Client hello extension with TLS1.3, Hence the request will not drop off in between Middlebox.

* TLS is providing forward end-to-end handshake encryption. Handshake will create a session keys which project an application data. Session keys will be derived from RSA & DS.

DS - It will share public key store and private key will delete after SEED establishment. It will support of forward Secrecy.

Client Hello is carrying on information about Version, Session ID and Cipher suites.

Below diagram will give a details about 11 keys of TLS1.3.