RFC 8446

TLS 1.3 is a major revision that removes legacy cryptographic algorithms, reduces handshake latency to 1-RTT (and 0-RTT for resumption), and provides forward secrecy by default via ephemeral Diffie-Hellman key exchange.

In 3GPP 5G networks, TLS 1.3 is the mandatory transport security protocol for all SBI (Service-Based Interface) communications between Network Functions (TS 29.500 §5.2.1), SEPP N32-c signaling, and certificate-based mutual authentication.

TLS 1.3 secures all HTTP/2-based SBI communication in the 5G core:

• NF ↔ NF: All service-based interface communication (Namf, Nsmf, Nausf, etc.) over HTTP/2 + TLS 1.3
• NF ↔ NRF: NF registration, discovery, and OAuth 2.0 token exchange
• NF ↔ SCP: Service Communication Proxy for indirect communication (Model C/D)
• SEPP ↔ SEPP: N32-c control plane between SEPPs uses TLS 1.3
• Mutual TLS: TS 33.501 §13.1 requires mutual authentication with client certificates

TLS 1.3 dramatically simplifies the handshake to a single round trip:

  Client                                  Server
|                                        |
|  ClientHello                            |
|  + key_share (ECDHE)                   |
|  + supported_versions (1.3)            |
|  + signature_algorithms               |
|  + server_name (SNI)                   |
|--------------------------------------->|
|                                        |
|                        ServerHello     |
|                  + key_share (ECDHE)   |
|              {EncryptedExtensions}     |
|              {CertificateRequest*}     |
|              {Certificate}             |
|              {CertificateVerify}       |
|              {Finished}               |
|<---------------------------------------|
|                                        |
|  {Certificate*}                        |
|  {CertificateVerify*}                  |
|  {Finished}                            |
|--------------------------------------->|
|                                        |
|  [Application Data]  <===============> |

TLS 1.3 drastically reduces the cipher suite space. All cipher suites provide AEAD encryption and are paired with HKDF for key derivation:

TLS 1.3 uses HKDF (RFC 5869) for all key derivation, providing a clean key schedule:

  PSK (or 0)                 (EC)DHE (or 0)
|                          |
v                          v
HKDF-Extract ← 0          HKDF-Extract ← Early Secret
|                          |
+→ binder_key               |
+→ client_early_traffic    |
|                          |
v                          v
Derive-Secret(., "derived", "")
|                          |
v                          |
HKDF-Extract ← (EC)DHE -------+
|                     Handshake Secret
+→ client_handshake_traffic_secret
+→ server_handshake_traffic_secret
|
v
Derive-Secret(., "derived", "")
|
v
HKDF-Extract ← 0
|                     Master Secret
+→ client_application_traffic_secret_0
+→ server_application_traffic_secret_0
+→ exporter_master_secret
+→ resumption_master_secret

TLS 1.3 supports 0-RTT (zero round-trip time) resumption using pre-shared keys from a previous session. Application data can be sent in the first flight.

TS 33.310 and TS 33.501 specify certificate requirements for TLS in 5G:

• Certificate profiles: X.509v3 with Subject Alternative Name (SAN) containing NF FQDN
• Signature algorithms: ECDSA with P-256/P-384 (preferred), RSA-PSS with 2048+ bit keys
• Key exchange: Ephemeral ECDHE with secp256r1 or secp384r1 (MUST support)
• Certificate chains: Operator CA hierarchy per TS 33.310 §6
• Revocation: OCSP stapling (RFC 6960) or CRL distribution points

• Forward secrecy: Mandatory via ephemeral DH — compromise of long-term key does not reveal past sessions
• Downgrade prevention: Transcript hash in Finished message prevents version downgrade
• Encrypted handshake: Server certificate and extensions are encrypted (unlike TLS 1.2)
• Removed: RSA key exchange, static DH, CBC mode, RC4, MD5, SHA-1, compression, renegotiation
• ALPN: Application-Layer Protocol Negotiation for h2 (HTTP/2) selection in SBI