# TLS 1.3 server_handshake_traffic_secret calculation

I'm currently reading the Transport Layer Security (TLS) Protocol Version 1.3.

In section 4.3.1 (Encrypted Extensions) it says

In all handshakes, the server MUST send the EncryptedExtensions message immediately after the ServerHello message. This is the first message that is encrypted under keys derived from the server_handshake_traffic_secret.

How exactly is that server_handshake_traffic_secret calculated? Where does it come from?

I try to find out how all the application-data (e.g. certificate) in the server-hello is encrypted.

It should have something to do with an HKDF-Extract function. In the client-hello there is a random byte-string and a filled key-exchange extension. I assume that the (first) use of HKDF during the server-hello must base on that. But how exactly?

• Did you check section 7.1? – Peter Harmann Apr 27 '18 at 11:59
• Yes! (I've hyperlinked it in my question.) The first argument of the function Derive-Secret is Secret. What is Secret? – user1511417 Apr 27 '18 at 12:12
• It is clearly written there: "Derive-Secret's Secret argument is indicated by the incoming arrow. For instance, the Early Secret is the Secret for generating the client_early_traffic_secret." – Peter Harmann Apr 27 '18 at 12:25
• Okay Early Secret is the Secret for the first Derive-Secret-Call. Early Secret is computed with HKDF-Extract using PSK. What PSK? There is no PSK in the very first client-hello. – user1511417 Apr 27 '18 at 14:09
• Read the section carefully, the PSK is initially some zero bytes: If a given secret is not available, then the 0-value consisting of a string of Hash.length bytes set to zeros is used – Lekensteyn Apr 27 '18 at 23:41

maybe this pdf will help you. client and server will use DH result as PMS, just like TLS1.2 use DH result as pre-masterkey, then the middler can't know the encrypt key.

server_handshake_traffic_secret is generated as Section 7.1 of the RFC. This is later used in generating verify data of Finished message.
See page 72 of RFC which state

 The key used to compute the Finished message is computed from the
Base Key defined in Section 4.4 using HKDF (see Section 7.1).
Specifically:

finished_key =
HKDF-Expand-Label(BaseKey, "finished", "", Hash.length)


Here Base Key is nothing but server_handshake_traffic_secret.
In TLS 1.3 server generates following.

• handshake secret : This is later used in generating application secret key.
• client handshake traffic secret: For use in Finished message as explained above.
• server handshake traffic secret: For use in Finished message as explained above. Below are used to used to encrypt the extension.
• client handshake key:
• server handshake key:
• client handshake IV:
• server handshake IV: