In TLS 1.3, handshake messages after Hello and KeyShare--e.g., certificates, signature, finished--are encrypted using an AEAD cipher. Can someone explain what the rationale is? Is it mainly for privacy or integrity, or both?

It doesn't seem to be for integrity because the Finished message should already do that. If it were there for privacy, though, the benefit seems limited. Server identity can still be leaked by other means such as server_name or SNI extension sent by a client. Did I miss something?

1 Answer 1


The handshake was integrity protected already in previous TLS versions. The early encryption is explicitly done to get more confidentially, especially to encrypt the certificate which is a major source of meta information in deep packet inspection.

Server identity can still be leaked by other means such as server_name or SNI extension sent by a client.

It was originally planned to encrypt SNI too and was also in the earlier drafts of TLS 1.3 but it did not made it into the final version. But there is a draft for Encrypted SNI and it is implemented in some CDN like Cloudflare already and also in some browsers like Firefox. Note that ESNI is mainly useful when lots of domains are served by the same IP address which is the case mainly for CDN or large hosting providers.

There is also plain DNS as an additional leak of metadata for deep packet inspection - this is addressed by DNS over HTTPS and DNS over TLS.

This does not mean that everything is perfect, but at least less meta information are leaked than before and it gets harder for simple passive DPI to collect user information.

  • interesting. Especially the historic note. What are the application scenarios? Anti-censorship? Also do you have a reference (eg a section in the RFC) on this?
    – qweruiop
    Commented Jan 10, 2020 at 7:00
  • @qweruiop: I cannot see an objective for the design decision in the RFC, apart from the generic that TLS should provide confidentiality. But this article on the IETF blog explicitly says "In contrast to TLS 1.2, TLS 1.3 provides additional privacy for data exchanges by encrypting more of the negotiation handshake to protect it from eavesdroppers. This enhancement helps protect the identities of the participants and impede traffic analysis.". And DPI is used a lot and also for censorship but also for example for security in company firewalls. Commented Jan 10, 2020 at 7:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .