← All tools
Protocols
TLS 1.3 key schedule: from ECDH to a traffic key
Run a real ECDH exchange, feed it through real HKDF bound to a transcript hash, and use the result to AES-GCM-encrypt a record — the exact chain TLS 1.3 runs on every connection.
What's happening under the hood →·Read the TLS in practice: how HTTPS puts it all together module for the full explanation →
1. Run the handshake
Real ECDH key pairs for Client and Server, a real transcript hash, and real HKDF — deriving one traffic key each, independently.
2. Encrypt application data (as the client)
3. Decrypt it (as the server)