EXERCISE 1 — Comparing TLS 1.3 vs 1.2 message flows
====================================================

Commands (same server, two versions):
  openssl s_client -connect example.com:443 -servername example.com -tls1_3 -msg </dev/null
  openssl s_client -connect example.com:443 -servername example.com -tls1_2 -msg </dev/null

TLS 1.2 flow (what you saw in Chapter 6):
  >>> ClientHello
  <<< ServerHello
  <<< Certificate            <-- IN THE CLEAR (visible as a plaintext msg)
  <<< ServerKeyExchange
  <<< ServerHelloDone
  >>> ClientKeyExchange
  >>> ChangeCipherSpec
  >>> Finished
  <<< ChangeCipherSpec
  <<< Finished

TLS 1.3 flow:
  >>> ClientHello   (now carries a "key_share" extension = client's DH value)
  <<< ServerHello   (carries the server's "key_share")
  <<< ChangeCipherSpec   (a dummy "compatibility" message, ignored)
  <<< [Encrypted Extensions]
  <<< [Certificate]        <-- ENCRYPTED (shown as application-data /
  <<< [CertificateVerify]      encrypted handshake, not a cleartext msg)
  <<< [Finished]
  >>> [Finished]
  ... application data ...

WHAT DISAPPEARS OR MOVES IN 1.3:
  - ServerKeyExchange and ClientKeyExchange are GONE as separate messages:
    the DH key shares now ride inside ClientHello / ServerHello (key_share).
  - ServerHelloDone is GONE (no longer needed — server sends everything in
    one flight).
  - The server's Certificate, CertificateVerify, and Finished are sent in
    the SAME flight as ServerHello, and they are ENCRYPTED.
  - Net effect: 1 round trip instead of 2.

CONFIRMING THE CERTIFICATE IS ENCRYPTED IN 1.3:
  - In the -tls1_2 dump you can literally see "<<< TLS 1.2 Handshake
    [Certificate]" as a readable handshake message, and the cert bytes are
    on the wire in the clear.
  - In the -tls1_3 dump the certificate is NOT shown as a cleartext
    handshake message; it appears after encryption begins (as encrypted
    records). A passive sniffer (e.g. Wireshark) sees the cert in 1.2 but
    NOT in 1.3.
  - Privacy win: in 1.3 an eavesdropper can't read which certificate /
    identity the server presented (though SNI in ClientHello still leaks
    the hostname unless Encrypted Client Hello is used — a newer addition).