8.5 Elliptic curves in TLS 1.3

Elliptic curves provide one option within the TLS handshake protocol for server Alice and client Bob to agree on a shared secret. First of all, Alice and Bob have to negotiate whether they want to use elliptic curves at all, and which curve they are going to use.

The supported˙groups extension that client Bob sends to server Alice in his ClientHello message to negotiate the cryptographic parameters contains a list of groups that Bob wants to use to establish the secret key with Alice via ECDH. The list is ordered according to Bob’s preference in descending order.

Technically, the supported˙groups extension has a field called extension˙data. This field contains a value of the type NamedGroupList, defined as shown in Listing 8.1.

Listing 8.1: NamedGroupList in supported_groups extension

struct {
   NamedGroup named_group_list<2..2^16-1>;
} NamedGroupList;

Each entry in NamedGroupList is a named group...