TLS client state machine – TLS Handshake Protocol Revisited
13.1 TLS client state machine
Appendix A of RFC 8446, the IETF specification of TLS 1.3, summarizes valid states and state transitions for TLS 1.3 server and client. The client state machine is shown in Figure 13.1. Labels in square brackets indicate actions the client performs only under specific circumstances. Label k = x indicates that the key k is set to value x.
Figure 13.1: State machine and state transitions of a TLS 1.3 client
Client Bob starts the TLS handshake by sending the ClientHello message to server Alice. If Bob and Alice have agreed upon a secret key in a previous TLS session, Bob may use this key to encrypt early data.
Bob then transitions into state WAIT˙SH, denoted by WSH, where he waits for the ServerHello message from Alice. If Bob’s ClientHello contains parameter values that Alice does not support, she replies with a HelloRetryRequest message, thereby making Bob switch back to the initial state and re-send ClientHello with different parameters.
If, on the other hand, Bob receives a ServerHello while he is in the state WSH, he sets the secret key and switches to the state WAIT˙EE, denoted by WEE in Figure 13.1, where he waits for EncryptedExtensions from Alice.
Upon receiving EncryptedExtensions, Bob switches to the state WAIT˙CERT˙CR, denoted as WCR, if he wants Alice to authenticate herself using a digital certificate. While in the state WCR, Bob either receives Alice’s certificate and switches to state WAIT˙CV, denoted as WCV , or receives a CertificateRequest from Alice asking Bob to authenticate himself using a certificate and switches to the state WAIT˙CERT, denoted as WCE.
From WCE, Bob transitions into state WCV upon receiving Alice’s certificate. In the next step, upon receiving the CertificateVerify message from Alice, Bob transitions into the WAIT˙FINISHED state, denoted as WF .
Alternatively, while in state WEE, Bob might decide to use a pre-shared secret key and, as a result, let Alice authenticate herself implicitly by using the correct pre-shared key. In this case, Bob switches from WEE to the state WF .
While in the state WF , Bob switches to the state CONNECTED, denoted by C, upon receiving the Finished message from Alice. If appropriate, Bob sends EndOfEarlyData as well as his own Certificate and CertificateVerify messages. Finally, Bob sends his Finished message and transitions into state C.