Cybersecurity glossary
What is TLS 1.3?
Learn what TLS 1.3 is, how its 1-RTT handshake and AEAD-only ciphers improve security, what changed from TLS 1.2, and how to deploy it safely.
Definition
TLS 1.3 is the Transport Layer Security protocol version defined in RFC 8446 that mandates ephemeral key agreement, AEAD-only record protection, a simplified cipher suite list, and a reduced-round-trip handshake for securing network communications.
Why TLS 1.3 is the modern default
TLS 1.2’s flexibility became a liability: insecure suites lingered for years. TLS 1.3 deletes entire classes of footguns, encrypts more of the handshake, and standardizes forward-secret AEAD protection so secure deployments are easier to get right.
Major TLS 1.3 improvements
AEAD only
Record protection uses authenticated encryption exclusively.
Ephemeral agreement
Key exchange uses modern named groups with forward secrecy.
Fewer round trips
Typical handshakes complete faster on high-latency links.
Encrypted extensions
More handshake metadata is protected from network observers.
Simplified TLS 1.3 handshake flow
ClientHello with key shares
Client offers versions, AEAD suites, and key agreement shares.
ServerHello and encrypted extensions
Server selects parameters and continues under handshake keys.
Certificate and Finished
Server authenticates; both sides confirm the transcript.
Application data
AEAD keys protect HTTP or other application protocols.
TLS 1.2 vs TLS 1.3 highlights
TLS 1.3 is intentionally less configurable in dangerous ways.
| Topic | TLS 1.2 | TLS 1.3 |
|---|---|---|
| Legacy ciphers | Possible unless disabled | Removed from the version |
| Key exchange | May lack FS if misconfigured | Ephemeral by design |
| Suite naming | Exchange+auth+cipher+MAC | Mostly AEAD+hash |
| Handshake RTTs | Often 2-RTT full handshake | Typically 1-RTT full handshake |
Operational checklist
- Enable TLS 1.3 on public HTTPS and modern APIs.
- Keep a hardened TLS 1.2 fallback only while clients require it.
- Evaluate whether 0-RTT early data is worth replay controls for your app.
- Confirm CDNs and middleboxes actually negotiate 1.3 end to end.
- Monitor version metrics so unexpected 1.2-only traffic is investigated.
- Maintain certificate automation; protocol upgrades do not replace PKI hygiene.
- Update old clients that advertise only obsolete versions.
- Re-run scanner baselines after enabling 1.3 to catch termination-path gaps.
Middleboxes and myths
Some enterprises historically blocked TLS 1.3 due to inspection products that expected clear handshake fields. Modern inspection and privacy trade-offs should be explicit decisions—not silent version freezes that leave users on weaker stacks.
The practical takeaway
TLS 1.3 is the preferred TLS version for new and upgraded services: AEAD-only cryptography, forward secrecy by default, and a faster handshake. Enable it widely and retire weaker configurations as clients allow.
Related security terms
TLS 1.2
The previous major TLS version still used for compatibility.
TLS Handshake
How TLS 1.3 shortens negotiation while authenticating peers.
Forward Secrecy
TLS 1.3 requires ephemeral key agreement, strengthening FS by default.
AEAD
TLS 1.3 record protection uses only AEAD ciphers.
ECDHE
Common ephemeral key agreement underlying TLS 1.3 named groups.
Frequently asked questions
What is TLS 1.3 in simple terms?
It is the modern TLS version that encrypts internet traffic with fewer insecure options and a faster handshake than TLS 1.2.
Is TLS 1.3 faster?
Often yes. The full handshake typically needs one round trip, and session resumption can be even quicker. Exact gains depend on network latency.
What happened to old cipher suites?
TLS 1.3 removed RSA key transport, CBC modes, RC4, and other legacy constructions. Suites now mainly name the AEAD cipher and hash.
What is 0-RTT in TLS 1.3?
An optional early-data mode that can send application data even sooner on resumption, with replay risks that applications must consider.
Should I disable TLS 1.2 after enabling 1.3?
Only when your client population no longer needs it. Many servers offer both, with 1.3 preferred.
Does TLS 1.3 change certificates?
Certificate validation still matters. You still need valid chains and SAN hostname matches.
Is TLS 1.3 immune to downgrade attacks?
It includes stronger downgrade protections, but servers that still offer weak older versions can be attacked at the version-selection layer if clients allow them.
References
Explore authoritative guidance and frameworks related to tls 1.3.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.