17.3 TLS record payload protection
As illustrated in Figure 17.1, before data is transmitted over the wire, the TLS record protection functions – denoted by E in Figure 17.1 – encrypt TLSPlaintext structures into TLSCiphertext structures.
Figure 17.1: Protection of TLS record payload
On the receiver side, TLS record layer functions are used to reverse the process by translating TLSCiphertext structures into TLSPlaintext structures. Every encrypted TLS record is composed of a plaintext header and an encrypted body. The body contains a type and optional padding.
In TLS 1.3, all ciphers used to encrypt TLSPlaintext into TLSCiphertext use the Authenticated Encryption with Associated Data (AEAD) mode of operation. Recall that AEAD offers encryption and message authentication in a single cryptographic algorithm that turns plaintext into an authenticated ciphertext. This, in turn, allows the receiving party to verify that the ciphertext was not manipulated while...