17.4 Per-record nonce
Alice and Bob keep a 64-bit sequence number for reading and writing TLS records. They increment this number every time they read or write a TLS record.
At the start of a TLS session and whenever the shared secret traffic key is changed, Alice and Bob set this number to zero. The first TLS record transmitted under that key has 0 as its sequence number.
In practice, TLS sequence numbers do not wrap because of their size: in most typical scenarios Alice and Bob exchange much less than 264 records. For the unlikely case where the sequence number must be wrapped, TLS 1.3 specification tells Alice and Bob to either change that secret traffic key or end their TLS connection.
AEAD algorithms specify the range of valid per-record nonce lengths. The record-specific nonce for an AEAD algorithm is constructed like this:
The 64-bit sequence number of the TLS record is encoded in the network byte order.
In the next step, the encoded number is padded with zeros to the left...
