Understanding the TLS Handshake: What It Takes to Unlock the Padlock

When you navigate to a website and see that familiar padlock icon in your browser, a complex process has taken place to ensure your connection is secure. In this post, we will explore the mechanics of the TLS handshake, the pivotal sequence that establishes a secure connection between your web browser and the server you are visiting.

To aid in our explanation, we recommend that you keep an infographic handy, which outlines the various exchanges and records as they occur during this handshake process.

Setting the Stage: The Purpose of TLS

Before we dive into the handshake, it’s essential to understand that the primary goals of SSL/TLS protocols are:

• ✅ Verifying the identity of the server.
• ✅ Establishing session keys to protect data transmitted during the session.

With these goals in mind, let’s break down the crucial steps involved in the TLS handshake.

1️⃣ The Client Hello

The handshake begins with a message from the Client, which is your web browser, known as the Client Hello. This message includes several key components:

• SSL Version: The highest version of SSL/TLS that the Client supports (e.g., TLS 1.2, TLS 1.3).
• Random Number: A 32-byte random value generated by the Client for enhancing security.
• Session ID: A unique identifier for a session, which can allow for session resumption in future connections.
• Cipher Suites: A list of encryption and authentication algorithms supported by the Client.
• Extensions: Features that enhance TLS functionalities beyond what was specified in earlier versions.

1.1 SSL Version

The Client informs the server of the highest SSL/TLS version available. The Server will respond with the highest compatible version, ensuring that both parties use the same secure protocol.

1.2 Random Number

This value helps to generate session keys. By adding randomness, it contributes to the entropy needed for secure communications.

1.3 Session ID

This feature allows the potential resumption of a previous session, simplifying future connections.

1.4 Cipher Suites

In this field, the Client expresses all the cipher suites it can support; the Server will choose one from this list to use.

1.5 Extensions

Extensions present additional functionalities, accommodating updates and improvements in secure communications without needing to overhaul the entire protocol.