Forward Secrecy and Ephemeral Key Exchange

Forward Secrecy, also known as Perfect Forward Secrecy (PFS), is a critical security property that Geode enforces through mandatory TLS 1.3. This cryptographic feature ensures that even if an attacker compromises your server’s long-term private key in the future, they cannot decrypt previously recorded encrypted sessions. Geode’s implementation of forward secrecy protects your graph data against “store now, decrypt later” attacks, making it essential for long-term data confidentiality. <h3 id="understanding-forward-secrecy" class="position-relative d-flex align-items-center group"> Understanding Forward Secrecy <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="understanding-forward-secrecy" aria-haspopup="dialog" aria-label="Share link: Understanding Forward Secrecy"> Share link </button> </h3><div id="headingShareModal" class="heading-share-modal" role="dialog" aria-modal="true" aria-labelledby="headingShareTitle" hidden> <div class="hsm-dialog" role="document"> <div class="hsm-header"> <h2 id="headingShareTitle" class="h6 mb-0 fw-bold">Share this section</h2> <button type="button" class="hsm-close" aria-label="Close"> </button> </div> <div class="hsm-body"> <label for="headingShareInput" class="form-label small text-muted mb-1 text-uppercase fw-bold" style="font-size: 0.7rem; letter-spacing: 0.5px;">Permalink</label> <div class="input-group mb-4 hsm-url-group"> <input id="headingShareInput" type="text" class="form-control font-monospace" readonly aria-readonly="true" style="font-size: 0.85rem;" /> <button class="btn btn-primary hsm-copy" type="button" aria-label="Copy" title="Copy"> </button> </div> <div class="small fw-bold mb-2 text-muted text-uppercase" style="font-size: 0.7rem; letter-spacing: 0.5px;">Share via</div> <div class="hsm-share-grid"> <a id="share-twitter" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> Twitter </a> <a id="share-linkedin" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> LinkedIn </a> <a id="share-facebook" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> Facebook </a> </div> </div> </div> </div> <style> .heading-share-modal { position: fixed; inset: 0; display: flex; justify-content: center; align-items: center; background: rgba(0, 0, 0, 0.6); z-index: 1050; padding: 1rem; backdrop-filter: blur(4px); -webkit-backdrop-filter: blur(4px); } .heading-share-modal[hidden] { display: none !important; } .hsm-dialog { max-width: 420px; width: 100%; background: var(--bs-body-bg, #fff); color: var(--bs-body-color, #212529); border: 1px solid var(--bs-border-color, rgba(0,0,0,0.1)); border-radius: 1rem; box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.25); overflow: hidden; animation: hsm-fade-in 0.2s ease-out; } @keyframes hsm-fade-in { from { opacity: 0; transform: scale(0.95); } to { opacity: 1; transform: scale(1); } } [data-bs-theme="dark"] .hsm-dialog { background: #1e293b; border-color: rgba(255,255,255,0.1); color: #f8f9fa; } .hsm-header { display: flex; justify-content: space-between; align-items: center; padding: 1rem 1.5rem; border-bottom: 1px solid var(--bs-border-color, rgba(0,0,0,0.1)); background: rgba(0,0,0,0.02); } [data-bs-theme="dark"] .hsm-header { background: rgba(255,255,255,0.02); border-color: rgba(255,255,255,0.1); } .hsm-close { background: transparent; border: none; color: inherit; opacity: 0.5; padding: 0.25rem 0.5rem; border-radius: 0.25rem; font-size: 1.2rem; line-height: 1; transition: opacity 0.2s; } .hsm-close:hover { opacity: 1; } .hsm-body { padding: 1.5rem; } .hsm-url-group { display: flex !important; align-items: stretch; } .hsm-url-group .form-control { flex: 1; min-width: 0; margin: 0; background: var(--bs-secondary-bg, #f8f9fa); border-color: var(--bs-border-color, #dee2e6); border-top-right-radius: 0; border-bottom-right-radius: 0; height: 42px; } .hsm-url-group .btn { flex: 0 0 auto; margin: 0; margin-left: -1px; border-top-left-radius: 0; border-bottom-left-radius: 0; height: 42px; display: flex; align-items: center; justify-content: center; padding: 0 1.25rem; z-index: 2; } [data-bs-theme="dark"] .hsm-url-group .form-control { background: #0f172a; border-color: #334155; color: #e2e8f0; } .hsm-share-grid { display: flex; flex-direction: column; gap: 0.5rem; } .hsm-share-grid .btn { display: flex; align-items: center; justify-content: center; font-size: 0.9rem; padding: 0.6rem; border-color: var(--bs-border-color); width: 100%; } [data-bs-theme="dark"] .hsm-share-grid .btn { color: #e2e8f0; border-color: #475569; } [data-bs-theme="dark"] .hsm-share-grid .btn:hover { background: #334155; border-color: #cbd5e1; } </style> <script> (function(){ const modal = document.getElementById('headingShareModal'); if(!modal) return; const input = modal.querySelector('#headingShareInput'); const copyBtn = modal.querySelector('.hsm-copy'); const twitter = modal.querySelector('#share-twitter'); const linkedin = modal.querySelector('#share-linkedin'); const facebook = modal.querySelector('#share-facebook'); const closeBtn = modal.querySelector('.hsm-close'); let lastFocus=null; let trapBound=false; function buildUrl(id){ return window.location.origin + window.location.pathname + '#' + id; } function isOpen(){ return !modal.hasAttribute('hidden'); } function hydrate(id){ const url=buildUrl(id); input.value=url; const enc=encodeURIComponent(url); const text=encodeURIComponent(document.title); if(twitter) twitter.href=`https://twitter.com/intent/tweet?url=${enc}&text=${text}`; if(linkedin) linkedin.href=`https://www.linkedin.com/sharing/share-offsite/?url=${enc}`; if(facebook) facebook.href=`https://www.facebook.com/sharer/sharer.php?u=${enc}`; } function openModal(id){ lastFocus=document.activeElement; hydrate(id); if(!isOpen()){ modal.removeAttribute('hidden'); } requestAnimationFrame(()=>{ input.focus(); }); trapFocus(); } function closeModal(){ if(!isOpen()) return; modal.setAttribute('hidden',''); if(lastFocus && typeof lastFocus.focus==='function') lastFocus.focus(); } function copyCurrent(){ try{ navigator.clipboard.writeText(input.value).then(()=>feedback(true),()=>fallback()); } catch(e){ fallback(); } } function fallback(){ input.select(); try{ document.execCommand('copy'); feedback(true);}catch(e){ feedback(false);} } function feedback(ok){ if(!copyBtn) return; const icon=copyBtn.querySelector('i'); if(!icon) return; const prev=copyBtn.getAttribute('data-prev')||icon.className; if(!copyBtn.getAttribute('data-prev')) copyBtn.setAttribute('data-prev',prev); icon.className= ok ? 'fa-duotone fa-clipboard-check':'fa-duotone fa-circle-exclamation'; setTimeout(()=>{ icon.className=prev; },1800); } function handleShareClick(e){ e.preventDefault(); const btn=e.currentTarget; const id=btn.getAttribute('data-share-target'); if(id) openModal(id); } function bindShareButtons(){ document.querySelectorAll('.h-share').forEach(btn=>{ if(!btn.dataset.hShareBound){ btn.addEventListener('click', handleShareClick); btn.dataset.hShareBound='1'; } }); } bindShareButtons(); if(document.readyState==='loading'){ document.addEventListener('DOMContentLoaded', bindShareButtons); } else { requestAnimationFrame(bindShareButtons); } document.addEventListener('click', function(e){ const shareBtn=e.target.closest && e.target.closest('.h-share'); if(shareBtn && !shareBtn.dataset.hShareBound){ handleShareClick.call(shareBtn, e); } }, true); document.addEventListener('click', e=>{ if(e.target===modal) closeModal(); if(e.target.closest && e.target.closest('.hsm-close')){ e.preventDefault(); closeModal(); } if(copyBtn && (e.target===copyBtn || (e.target.closest && e.target.closest('.hsm-copy')))) { e.preventDefault(); copyCurrent(); } }); document.addEventListener('keydown', e=>{ if(e.key==='Escape' && isOpen()) closeModal(); }); function trapFocus(){ if(trapBound) return; trapBound=true; modal.addEventListener('keydown', f=>{ if(f.key==='Tab' && isOpen()){ const focusable=[...modal.querySelectorAll('a[href],button,input,textarea,select,[tabindex]:not([tabindex="-1"])')].filter(el=>!el.hasAttribute('disabled')); if(!focusable.length) return; const first=focusable[0]; const last=focusable[focusable.length-1]; if(f.shiftKey && document.activeElement===first){ f.preventDefault(); last.focus(); } else if(!f.shiftKey && document.activeElement===last){ f.preventDefault(); first.focus(); } } }); } if(closeBtn) closeBtn.addEventListener('click', e=>{ e.preventDefault(); closeModal(); }); })(); </script>Forward secrecy addresses a fundamental vulnerability in traditional public key cryptography: if an attacker records encrypted traffic today and later obtains the server’s private key (through theft, legal compulsion, or cryptographic advances), they could decrypt all historical communications. <h4 id="the-problem-without-forward-secrecy" class="position-relative d-flex align-items-center group"> The Problem Without Forward Secrecy <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="the-problem-without-forward-secrecy" aria-haspopup="dialog" aria-label="Share link: The Problem Without Forward Secrecy"> Share link </button> </h4>Without forward secrecy, a single key compromise can be catastrophic: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback">Time T1: Attacker records encrypted traffic Client <------ Encrypted Session ------> Server (Recorded by attacker) Time T2: Server's private key compromised Attacker obtains server private key Time T3: Historical decryption possible Attacker decrypts ALL recorded sessions </code></pre></div>This vulnerability is particularly concerning because: <ul> <li>Nation-state adversaries may record encrypted traffic at scale</li> <li>Storage costs continue to decrease, making bulk storage feasible</li> <li>Quantum computers may eventually break current asymmetric cryptography</li> <li>Key theft through breaches or insider threats is always possible</li> </ul> <h4 id="how-forward-secrecy-protects-data" class="position-relative d-flex align-items-center group"> How Forward Secrecy Protects Data <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="how-forward-secrecy-protects-data" aria-haspopup="dialog" aria-label="Share link: How Forward Secrecy Protects Data"> Share link </button> </h4>With forward secrecy, each session uses unique ephemeral keys: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback">Session 1: Client generates ephemeral key pair K1 Server generates ephemeral key pair K1' Session key derived from K1 and K1' K1 and K1' deleted after session Result: Compromising server's long-term key reveals NOTHING about past sessions </code></pre></div> <h3 id="tls-13-and-forward-secrecy" class="position-relative d-flex align-items-center group"> TLS 1.3 and Forward Secrecy <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="tls-13-and-forward-secrecy" aria-haspopup="dialog" aria-label="Share link: TLS 1.3 and Forward Secrecy"> Share link </button> </h3>Geode exclusively uses TLS 1.3, which mandates forward secrecy for all connections. Unlike earlier TLS versions where forward secrecy was optional, TLS 1.3 removed all non-forward-secret cipher suites. <h4 id="tls-13-key-exchange" class="position-relative d-flex align-items-center group"> TLS 1.3 Key Exchange <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="tls-13-key-exchange" aria-haspopup="dialog" aria-label="Share link: TLS 1.3 Key Exchange"> Share link </button> </h4><table> <thead> <tr> <th>Algorithm</th> <th>Description</th> <th>Performance</th> <th>Security Level</th> </tr> </thead> <tbody> <tr> <td>X25519</td> <td>Curve25519 ECDHE</td> <td>Fastest</td> <td>128-bit equivalent</td> </tr> <tr> <td>secp384r1</td> <td>P-384 ECDHE</td> <td>Fast</td> <td>192-bit equivalent</td> </tr> </tbody> </table> <h4 id="the-tls-13-handshake" class="position-relative d-flex align-items-center group"> The TLS 1.3 Handshake <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="the-tls-13-handshake" aria-haspopup="dialog" aria-label="Share link: The TLS 1.3 Handshake"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback">Client Server |---- ClientHello + Key Share (X25519) ------->| |<--- ServerHello + Key Share (X25519) --------| |<--- {EncryptedExtensions, Certificate} ------| |<--- {CertificateVerify, Finished} -----------| |--- {Finished} ------------------------------>| |<========= Application Data (Encrypted) =====>| Key Points: - Both parties contribute ephemeral keys - Session keys derived from ephemeral exchange - Long-term keys only used for authentication - Ephemeral keys discarded after handshake </code></pre></div> <h3 id="geode-configuration" class="position-relative d-flex align-items-center group"> Geode Configuration <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="geode-configuration" aria-haspopup="dialog" aria-label="Share link: Geode Configuration"> Share link </button> </h3> <h4 id="default-configuration" class="position-relative d-flex align-items-center group"> Default Configuration <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="default-configuration" aria-haspopup="dialog" aria-label="Share link: Default Configuration"> Share link </button> </h4>Geode enables forward secrecy by default with optimal settings: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Forward secrecy is automatic with TLS 1.3 geode serve --tls-cert=/etc/geode/certs/server.crt \ --tls-key=/etc/geode/certs/server.key # Check forward secrecy status geode tls-status --verbose # TLS Version: 1.3 # Key Exchange: X25519 (ECDHE) # Forward Secrecy: Enabled </code></pre></div> <h4 id="configuration-file" class="position-relative d-flex align-items-center group"> Configuration File <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="configuration-file" aria-haspopup="dialog" aria-label="Share link: Configuration File"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"># geode.yaml server: listen: "0.0.0.0:3141" tls: enabled: true cert_file: "/etc/geode/certs/server.crt" key_file: "/etc/geode/certs/server.key" min_version: "1.3" max_version: "1.3" key_exchange_preferences: - X25519 # Fastest, recommended - secp384r1 # Higher security level cipher_suites: - TLS_AES_256_GCM_SHA384 - TLS_CHACHA20_POLY1305_SHA256 </code></pre></div> <h4 id="verifying-forward-secrecy" class="position-relative d-flex align-items-center group"> Verifying Forward Secrecy <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="verifying-forward-secrecy" aria-haspopup="dialog" aria-label="Share link: Verifying Forward Secrecy"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Test with OpenSSL openssl s_client -connect geode.example.com:3141 -tls1_3 2>&1 | \ grep -E "(Protocol|Cipher|Server Temp Key)" # Protocol : TLSv1.3 # Cipher : TLS_AES_256_GCM_SHA384 # Server Temp Key: X25519, 253 bits </code></pre></div> <h3 id="client-library-configuration" class="position-relative d-flex align-items-center group"> Client Library Configuration <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="client-library-configuration" aria-haspopup="dialog" aria-label="Share link: Client Library Configuration"> Share link </button> </h3>Go Client: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-go" data-lang="go">config := &geode.Config{ Host: "geode.example.com:3141", TLS: &geode.TLSConfig{ MinVersion: tls.VersionTLS13, // Enforces forward secrecy CurvePreferences: []tls.CurveID{tls.X25519, tls.CurveP384}, }, } client, err := geode.NewClient(config) </code></pre></div>Python Client: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-python" data-lang="python">tls_config = TLSConfig( ca_file="/path/to/ca.crt", min_version="TLSv1.3", # Enforces forward secrecy ) async with Client(host="geode.example.com", port=3141, tls=tls_config) as client: result = await client.query("MATCH (n:Sensitive) RETURN n") </code></pre></div>Rust Client: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-rust" data-lang="rust">let tls_config = TlsConfig::new() .with_ca(PathBuf::from("ca.crt")) .with_min_version(TlsVersion::Tls13); let client = Client::builder().host("geode.example.com").tls(tls_config).build().await?; </code></pre></div> <h3 id="ephemeral-key-management" class="position-relative d-flex align-items-center group"> Ephemeral Key Management <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="ephemeral-key-management" aria-haspopup="dialog" aria-label="Share link: Ephemeral Key Management"> Share link </button> </h3>Geode handles ephemeral key management automatically with secure memory handling: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"># geode.yaml security: memory: secure_key_memory: true # Secure memory allocation for keys lock_key_memory: true # Prevent keys from being swapped to disk secure_erase: true # Zero memory before deallocation </code></pre></div> <h3 id="session-resumption" class="position-relative d-flex align-items-center group"> Session Resumption <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="session-resumption" aria-haspopup="dialog" aria-label="Share link: Session Resumption"> Share link </button> </h3>TLS 1.3 session resumption maintains forward secrecy through careful design: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"># geode.yaml tls: session_resumption: enabled: true ticket_lifetime: 86400 # 24 hours ticket_rotation: 3600 # Rotate keys hourly allow_0rtt: false # Disable for maximum security </code></pre></div><table> <thead> <tr> <th>Mode</th> <th>Forward Secrecy</th> <th>Latency</th> <th>Use Case</th> </tr> </thead> <tbody> <tr> <td>Full Handshake</td> <td>Full</td> <td>1-RTT</td> <td>First connection</td> </tr> <tr> <td>1-RTT Resumption</td> <td>Full</td> <td>1-RTT</td> <td>Subsequent connections</td> </tr> <tr> <td>0-RTT Resumption</td> <td>Partial</td> <td>0-RTT</td> <td>Performance-critical reads</td> </tr> </tbody> </table> <h3 id="quantum-computing-preparedness" class="position-relative d-flex align-items-center group"> Quantum Computing Preparedness <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="quantum-computing-preparedness" aria-haspopup="dialog" aria-label="Share link: Quantum Computing Preparedness"> Share link </button> </h3>Forward secrecy is especially important for quantum computing threats: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback">With Forward Secrecy: - Even if future quantum computer breaks server key - Past session keys remain protected - Each session used unique ephemeral keys - Historical traffic stays encrypted (AES-256 quantum-resistant) </code></pre></div> <h3 id="monitoring-and-verification" class="position-relative d-flex align-items-center group"> Monitoring and Verification <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="monitoring-and-verification" aria-haspopup="dialog" aria-label="Share link: Monitoring and Verification"> Share link </button> </h3> <h4 id="tls-metrics" class="position-relative d-flex align-items-center group"> TLS Metrics <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="tls-metrics" aria-haspopup="dialog" aria-label="Share link: TLS Metrics"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash">geode metrics | grep -E "(tls_|forward_secrecy)" # tls_handshakes_total{key_exchange="X25519"} 15234 # tls_forward_secrecy_enabled 1 </code></pre></div> <h4 id="audit-logging" class="position-relative d-flex align-items-center group"> Audit Logging <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="audit-logging" aria-haspopup="dialog" aria-label="Share link: Audit Logging"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml">audit: enabled: true log_tls_parameters: true include: [tls_version, cipher_suite, key_exchange, forward_secrecy_status] </code></pre></div> <h3 id="troubleshooting" class="position-relative d-flex align-items-center group"> Troubleshooting <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="troubleshooting" aria-haspopup="dialog" aria-label="Share link: Troubleshooting"> Share link </button> </h3><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Check if forward secrecy is active geode tls-verify --host=geode.example.com:3141 # TLS 1.3: Yes # Forward Secrecy: Enabled # Key Exchange: X25519 </code></pre></div>Common Issues: <ul> <li>TLS 1.2 connections rejected: Update client to support TLS 1.3</li> <li>Key exchange mismatch: Ensure client and server share common algorithms</li> <li>Protocol downgrade: Verify min_version is set to “1.3”</li> </ul> <h3 id="related-topics" class="position-relative d-flex align-items-center group"> Related Topics <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="related-topics" aria-haspopup="dialog" aria-label="Share link: Related Topics"> Share link </button> </h3><ul> <li><a href="/tags/tls/" >TLS Encryption</a> - Transport security configuration</li> <li><a href="/tags/post-quantum/" >Post-Quantum Cryptography</a> - Future-proofing security</li> <li><a href="/tags/encryption/" >Encryption</a> - Data encryption at rest</li> <li><a href="/tags/security/" >Security</a> - Security overview</li> <li><a href="/tags/authentication/" >Authentication</a> - Identity verification</li> <li><a href="/tags/compliance/" >Compliance</a> - Regulatory requirements</li> </ul> <h3 id="further-reading" class="position-relative d-flex align-items-center group"> Further Reading <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="further-reading" aria-haspopup="dialog" aria-label="Share link: Further Reading"> Share link </button> </h3><ul> <li><a href="/docs/architecture/security-architecture/" >Security Architecture</a> - Security design</li> <li><a href="/docs/ops/deployment/" >Deployment Guide</a> - Production deployment</li> <li><a href="/docs/security/session-management/" >Session Management</a> - Session security</li> <li>RFC 8446 - TLS 1.3 Specification</li> <li>NIST SP 800-52 Rev. 2 - TLS Implementation Guidelines</li> </ul>

Popular

Related Articles

Post-Quantum Readiness & Cryptography