Visual RFC.
ALL RFCs / RFC 5246
Read the RFC ↗
RFC 5246 / MECHANISMS

Pending and current keys

02

Read and write each have pending and current connection states.

This guide explains the 2008 publication. Superseded by RFC 8446, RFC 9846.

Related RFCs and changes

“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.

DIAGRAM§ 6.1 ↗
RFC 5246 · § 6.1EXAMPLE
3 / 3
Pending and current keysRead and write each have pending and current connection states. Current state: Protected record.Pending and current keysPending write statenew key / algorithmsCurrent write statenew key / algorithmsCCSFinishedrecord seq = 0Read and write state changes are independent.
03
Protected record

The next Finished record uses the new state, starting its record sequence at zero.

Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
KEY POINT

Sending ChangeCipherSpec makes the pending write state current.

  • Sending ChangeCipherSpec makes the pending write state current.
  • Receiving it makes the pending read state current.
  • The record sequence number resets when a state becomes active.
DETAILS

The illustration is schematic. Example values are illustrative; profiles and later security guidance can add requirements.

Read the RFC section ↗

Diagrams simplify the RFC. Read the linked sections for complete requirements.

Privacy
All chapters in this RFC
  1. A TLS 1.2 handshake
  2. Pending and current keys
  3. Records protect fragments
  4. Finished checks the transcript
  5. TLS 1.3 changes the design

Drawing view

Scroll the drawing to see every part. Playback controls stay above it.

RFC 9700 / CHAPTERS

Chapters

For full details, tables, algorithms, and exceptions, read the original RFC.

RFC status and corrections ↗