← All tools
Protocols
TLS 1.3 key schedule: from ECDH to a traffic key
Run a real ECDH exchange, feed it through real HKDF bound to a transcript hash, and use the result to AES-GCM-encrypt a record — the exact chain TLS 1.3 runs on every connection.
What's happening under the hood →·Read the TLS in practice: how HTTPS puts it all together module for the full explanation →
1. Run the handshake
Real ECDH key pairs for Client and Server, a real transcript hash, and real HKDF — deriving one traffic key each, independently.
TLS Client
Run the handshake to see the client's side of the exchange.
TLS Server
Run the handshake to see the server's side of the exchange.
2. Encrypt application data (as the client)
3. Decrypt it (as the server)