Negotiating Encryption Without the Key
TLS 1.3 begins with a handshake where the client and server negotiate cipher suites and derive a shared secret, using public-key cryptography. The client sends a ClientHello listing supported algorithms and a public key. The server responds with a ServerHello, selects the strongest common cipher, provides its certificate (proving identity), and computes a shared encryption key using its private key.
The security relies on asymmetric cryptography: the server's private key proves it owns the certificate, but remains secret. Both parties derive the same shared secret (the session key) without ever transmitting it. All subsequent application data is encrypted using this shared key and a cipher like AES-256-GCM.
Defenses Against Known Attacks
TLS 1.3 eliminated downgrade attacks by requiring the ServerHello to be encrypted and authenticated under the negotiated cipher. An attacker cannot force the use of a weaker algorithm by modifying the ServerHello.
Perfect forward secrecy ensures that even if the server's long-term private key is compromised in the future, past sessions remain secure. TLS 1.3 uses ephemeral key exchange: the session key is derived fresh for each connection and discarded after. Replay attacks are defeated through the use of a single-use session key and application-level nonces. Certificate pinning and stapled OCSP responses further authenticate the server and detect revoked certificates without additional round-trips.