Skip to content
ecdsa.com

key_share extension

The TLS 1.3 extension (51) that carries the client's ephemeral public values for one or more groups and the server's single reply, letting the key exchange complete in the first round trip.
Also written askey_shareKeyShareEntrysupported_groups

A client usually sends shares for its preferred one or two groups, today often X25519MLKEM768 (1,216 bytes) plus x25519 (32 bytes). If none matches the server's preference among the client's supported_groups, the server answers with HelloRetryRequest naming the group, costing a round trip. P-256 shares are 65-byte uncompressed points (RFC 9846 §4.3.8.2).

Clients choose which shares to send speculatively, which is why large post-quantum shares were enabled only when they became the expected default. Servers must validate received shares: on-curve checks for P-256, ML-KEM encapsulation-key checks per FIPS 203, the all-zero check for X25519.

Standards and references

All terms