Protocols & PKIRecommended
TLS 1.3
Secure transport protocol
How it works
TLS 1.3 (RFC 8446, 2018) simplified the handshake to one round trip and encrypts more of it, including the server certificate. It removed RSA key transport and static Diffie-Hellman, so every connection uses ephemeral (EC)DHE and has forward secrecy. Only AEAD cipher suites remain, and the key schedule is built on HKDF.
Strengths
- Forward secrecy is mandatory.
- Removed legacy features: CBC suites, RC4, 3DES, compression, renegotiation and custom DH groups.
- Faster handshake (1-RTT, with optional 0-RTT resumption).
Weaknesses and known attacks
- 0-RTT early data can be replayed, so it must only be used for idempotent requests.
- Encrypted handshakes reduce what passive network monitoring tools can inspect.
Use it for
- All new TLS deployments: HTTPS, APIs, email transport, VPNs
Don't use it for
- 0-RTT for requests that change state
Exam tip
TLS 1.3 removed RSA key exchange and static DH and mandates forward secrecy. If asked how to guarantee PFS for HTTPS, enabling TLS 1.3 (or ECDHE-only TLS 1.2) is the answer.