Card 10/ 10
Recap: TLS
Three guarantees, one round trip, and a chain of signatures that has to reach a trusted root.
TLS protects a connection's content while leaving its outline visible.
- Three guarantees: encryption, integrity and authentication of the server.
- Still visible: addresses, ports, sizes, timing, and usually the site name in SNI.
- Position: between TCP and the application; inside QUIC for HTTP/3.
- The TLS 1.3 handshake takes one round trip: key shares first, then the certificate and Finished.
- Trust comes from a chain of signatures from the leaf, through intermediates the server must send, to a root in the client's store.
- Errors: expired, wrong name and unknown issuer each name one failed check.
- Mutual TLS adds a client certificate, so the server authenticates the client too.
- Networking
- Security
← → move through sections and cards