| Transport Layer Security (TLS) |
A protocol that provides confidentiality, integrity, and authentication on top of a reliable byte stream |
T01 |
| Secure Sockets Layer (SSL) |
The predecessor of TLS, now entirely obsolete |
T04 |
| round-trip time (RTT) |
The time from sending a packet until the reply comes back, the basic unit of handshake performance |
T01 |
| handshake |
The process of negotiating parameters, exchanging key material, and authenticating identities |
T05, T06 |
| record layer |
The layer that splits data into records and encrypts and authenticates them |
T05, T06 |
| cipher suite |
In TLS 1.2 a bundle of four choices, reduced in TLS 1.3 to the AEAD and the hash |
T05, T06 |
| extension |
An optional type-length-value field in messages such as ClientHello, and the main way TLS evolves |
T05, T06 |
| Server Name Indication (SNI) |
The target domain name, carried in the clear inside ClientHello |
T08 |
| Application-Layer Protocol Negotiation (ALPN) |
Selects an application protocol such as h2 or h3 during the handshake |
T01 |
| hash function |
A one-way function that compresses arbitrary data into a fixed-length fingerprint |
T02 |
| message authentication code (MAC), HMAC |
A keyed fingerprint that checks where data came from and whether it is intact |
T02 |
| authenticated encryption with associated data (AEAD) |
An interface that encrypts and authenticates in one step, such as AES-GCM |
T02 |
| block cipher |
A symmetric algorithm that encrypts fixed-size blocks, such as AES |
T02 |
| padding oracle attack |
Recovers plaintext from a response that distinguishes a padding error during decryption |
T02, T04 |
| public-key cryptography |
A cryptosystem in which the public key is public and the private key stays secret |
T02 |
| Diffie-Hellman (DH), ECDH |
Agrees a shared secret over a public channel |
T02 |
| ephemeral key exchange (DHE, ECDHE) |
Uses a fresh ephemeral private key for every handshake |
T02 |
| forward secrecy |
A leaked long-term private key does not open past sessions |
T02, T07 |
| digital signature |
Signed with the private key and checked with the public key, which proves the origin |
T02 |
| key derivation function (KDF), HKDF |
Derives many independent keys from one secret |
T02, T06 |
| pseudorandom function (PRF) |
The key derivation function used in TLS 1.2 |
T05 |
| premaster secret |
In TLS 1.2, the secret produced directly by the key exchange |
T05 |
| master secret |
In TLS 1.2, the 48-byte secret derived from the premaster secret and the random values |
T05 |
| extended master secret |
A way of computing the master secret that binds it to the handshake hash, which blocks the triple-handshake attack |
T04, T05 |
| key schedule |
In TLS 1.3, the derivation tree built from three HKDF-Extract steps |
T06 |
| transcript hash |
The hash of every handshake message up to a given moment |
T06 |
| traffic secret |
The secret from which the AEAD keys for one direction and one stage are derived |
T06 |
| key separation |
Each key is used for only one purpose |
T06 |
| downgrade attack |
Forces both peers onto a weaker version or algorithm |
T04, T06 |
| downgrade sentinel |
The DOWNGRD marker at the end of ServerHello.random |
T06, T13 |
| middlebox compatibility mode |
A disguise that makes a TLS 1.3 handshake look like a TLS 1.2 resumption |
T04, T06 |
| ossification |
Middleboxes come to depend on old protocol behavior, which blocks the protocol from evolving |
T04, T09 |
| GREASE |
Inserts reserved values at random so that an implementation does not fail on an unknown value |
T06, T08 |
| HelloRetryRequest (HRR) |
The server asks the client to resend ClientHello with a different group |
T06, T13 |
| session resumption |
Reuses an earlier session secret and skips the certificates and the signatures |
T07 |
| session ticket |
Session state that the server encrypts and gives the client to store |
T05, T07 |
| pre-shared key (PSK) |
The secret TLS 1.3 uses for resumption |
T07 |
| binder |
An HMAC that proves possession of the PSK and binds it to one specific ClientHello |
T07 |
| early data, 0-RTT |
Application data sent together with the ClientHello |
T07 |
| replay |
An attacker sends previously recorded data again |
T07 |
| certificate, X.509 |
A document, signed by a CA, that binds a public key to a name |
T03 |
| certificate authority (CA) |
An organization that checks an identity and issues certificates |
T03 |
| root certificate, trust anchor |
A certificate preinstalled in the root store, the starting point of trust |
T03 |
| intermediate certificate |
A CA certificate issued by a root and used day to day to issue site certificates |
T03 |
| root store, trust store |
The set of root certificates a device or a browser trusts |
T03 |
| root program |
The policy and process that decide which roots enter a root store |
T03, T12 |
| cross-signing |
An old root issues a certificate for a new root, so old devices can still validate it |
T03 |
| path building |
Finds a certificate path from the leaf to a trusted root |
T03 |
| subjectAltName (SAN) |
The list of domain names a certificate covers, and the only field a hostname check looks at |
T03 |
| nameConstraints |
An extension that limits a CA to a stated set of domain names |
T03 |
| revocation, CRL, OCSP |
Mechanisms that invalidate a certificate before it expires |
T03 |
| OCSP stapling |
The server attaches an OCSP response to the handshake |
T03 |
| Certificate Transparency (CT), SCT |
Every public certificate must be submitted to a public log |
T03 |
| Certification Authority Authorization (CAA) |
A DNS record that states which CAs may issue for a domain |
T03 |
| Automatic Certificate Management Environment (ACME) |
The protocol for requesting and renewing certificates automatically |
T03 |
| DV, OV, EV |
The levels of checking done before a certificate is issued: domain, organization, and extended validation |
T03 |
| certificate pinning |
Accept only a public key that was chosen in advance |
T12 |
| HTTP Strict Transport Security (HSTS), preload |
Makes the browser reach a domain only over HTTPS |
T12 |
| mixed content |
An HTTP subresource loaded by an HTTPS page |
T12 |
| Encrypted Client Hello (ECH) |
Encrypts the whole real ClientHello under a public key |
T08 |
| Hybrid Public Key Encryption (HPKE) |
The general public-key encryption construction that ECH uses |
T08 |
| Service Binding (SVCB) record, HTTPS record |
DNS records that publish ALPN, address hints, and ECH configuration |
T08 |
| encrypted DNS (DoH, DoT, DoQ) |
Carries DNS queries inside HTTPS, TLS, or QUIC |
T08 |
| anonymity set |
How many names ECH can hide the real target among |
T08 |
| QUIC |
A transport protocol implemented on UDP, with the TLS 1.3 handshake built in |
T09 |
| encryption level |
QUIC's Initial, 0-RTT, Handshake, and 1-RTT levels |
T09 |
| header protection |
QUIC hides the packet number and the flag bits using a sample of the ciphertext |
T09 |
| connection migration |
A QUIC connection continues after the IP address changes |
T09 |
| head-of-line blocking |
The loss of one packet blocks later data that has nothing to do with it |
T01, T09 |
| post-quantum cryptography (PQC) |
Public-key algorithms that resist a quantum computer |
T10 |
| Learning With Errors (LWE) |
The hard lattice problem that ML-KEM relies on |
T10 |
| key encapsulation mechanism (KEM) |
Encapsulates a random secret with the peer's public key |
T10 |
| hybrid key exchange |
Runs a classical key exchange and a post-quantum key exchange, and concatenates the secrets |
T10 |
| harvest now, decrypt later |
Record traffic now and decrypt it later with a quantum computer |
T10 |
| Merkle Tree Certificates (MTC) |
Certificates that use a Merkle inclusion proof in place of a CA signature |
T10 |
| kernel TLS (kTLS) |
Moves record-layer encryption and decryption into the kernel |
T07 |
| ShangMi (SM2, SM3, SM4), TLCP |
China's commercial cipher algorithms, and its transport-layer cryptography protocol |
T11 |
| key log, SSLKEYLOGFILE |
Records traffic secrets so you can decrypt a capture of your own traffic |
T06, T13 |