I'm currently reading the Transport Layer Security (TLS) Protocol Version 1.3.
In section 4.3.1 (Encrypted Extensions) it says
In all handshakes, the server MUST send the EncryptedExtensions message immediately after the ServerHello message. This is the first message that is encrypted under keys derived from the server_handshake_traffic_secret.
How exactly is that server_handshake_traffic_secret calculated? Where does it come from?
I try to find out how all the application-data (e.g. certificate) in the server-hello is encrypted.
It should have something to do with an HKDF-Extract function. In the client-hello there is a random byte-string and a filled key-exchange extension. I assume that the (first) use of HKDF during the server-hello must base on that. But how exactly?