Count the key material a TLS 1.3 handshake derives — traffic secrets, AEAD keys and IVs — including KeyUpdate rekeys.
TLS 1.3 runs a HKDF-based key schedule: Extract and Expand steps produce handshake and application traffic secrets for each direction, and each secret is expanded into a key and an IV. A KeyUpdate advances the traffic secret and regenerates both, which is how long-lived connections stay inside the AEAD usage limits. Every byte of derived material has to be zeroised and every HKDF call costs CPU, so at tens of thousands of connections per second the key schedule is a measurable part of the TLS budget and of your memory-hygiene obligations.
TLS Session Key
per direction TLS 1.3 derives one traffic secret (hash length) plus an AEAD key (16 or 32 B) and a 12-byte IV; each KeyUpdate re-derives all of them.
Per-record nonce construction
record nonce = 12-byte write IV XOR the 64-bit record sequence number.
per direction TLS 1.3 derives one traffic secret (hash length) plus an AEAD key (16 or 32 B) and a 12-byte IV; each KeyUpdate re-derives all of them. TLS 1.3 runs a HKDF-based key schedule: Extract and Expand steps produce handshake and application traffic secrets for each direction, and each secret is expanded into a key and an IV. A KeyUpdate advances the traffic secret and regenerates both, which is how long-lived connections stay inside the AEAD usage limits.
Every byte of derived material has to be zeroised and every HKDF call costs CPU, so at tens of thousands of connections per second the key schedule is a measurable part of the TLS budget and of your memory-hygiene obligations.
This calculator takes 3 inputs: Cipher suite, KeyUpdate rekeys per connection, New connections per second. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
The nonce length is a property of GCM, not the key length — SP 800-38D fixes the recommended nonce at 96 bits. TLS 1.3 derives a 12-byte static IV and XORs it with the record sequence number so nonces are unique and never random.