4 ms·

TLS 1.3 could have chosen to do without certificate encryption and it would have been easier to implement. I did not mean to trivialize the enormous work to mak

• tialaramex 8y ago
  No, encrypting certificates falls naturally out of the TLS 1.3 design so not doing this wouldn't have made it easier to implement. I can't help you here, you believe something that's flatly contradicted by the observable facts. Just in case anybody else is still reading this thread, here's why encrypting certificates falls out naturally: TLS 1.3 does key exchange (today some variant of Diffie-Hellman) up front. The first message from the client comes with proposed key shares with the client's half of DH done. This means when the server receives that message it can do its half of DH and immediately derive the resulting session keys. It will still need to transmit the public parts of its DH calculations back to the client in plaintext, but alongside and immediately after those it can use encryption, even though neither client nor server are authenticated yet. So everything further is encrypted, including certificates. The original SSL design uses RSA key exchange, which means nobody can encrypt anything until after the server's certificate has been sent, because the public key is baked into the certificate. This is clever because it inherently authenticates the remote server during key exchange, but it has numerous undesirable properties AND it's slower, so removing RSA key exchange was an early goal of TLS 1.3