Understanding the TLS Handshake: The Journey to Secure Connections 🔒

In today’s digital landscape, the presence of a padlock in your browser’s address bar signifies a secure connection between you and the websites you access. In this article, we will explore the intricacies of the TLS handshake process—the series of steps that occur to establish this crucial security.

To enhance your understanding, we recommend referencing the infographic linked here: TLS Handshake Infographic. Having this visual aid open as you read will provide context to the terms and processes we discuss.

Introduction

Before diving into the specifics of the handshake, it’s essential to grasp the primary goals of the SSL/TLS protocol:

• ✅ Verify the identity of the server
• ✅ Establish session keys to safeguard data transmission

We will address two foundational concepts integral to this process:

Records vs. Packets

The lines depicted in the infographic represent “Records” exchanged during the TLS handshake. It’s important to note that a Record is not synonymous with a Packet. A Packet can carry multiple Records, and conversely, multiple Packets may be necessary for a single Record.

Cryptography Basics

To understand the TLS handshake thoroughly, some familiarity with key cryptographic concepts is beneficial. While we won’t delve deeply into these areas here, we recommend looking into:

• Hashing
• MACs and HMACs
• Encryption

For a detailed overview of these concepts, informative videos are linked for your reference.

Now, let’s break down the records that constitute the TLS handshake:

1️⃣ Client Hello

The TLS handshake initiates with the Client (your web browser) sending a Client Hello message containing several critical fields:

• SSL Version
• Random Number
• Session ID
• Cipher Suites
• Extensions

Each of these components plays a critical role in achieving the handshake’s objectives.

1️⃣.1 SSL Version

The Client indicates the highest SSL version it supports (e.g., SSL 3.0, TLS 1.0, TLS 1.2). The server then responds with its own supported version, and they agree on the highest one they both recognize.

At present, only TLS 1.2 and TLS 1.3 are deemed secure.

1️⃣.2 Random Number

The