Understanding the TLS Handshake: What Gets You That Safe Padlock 🔒

When you visit a website and notice that familiar padlock icon in the address bar, it’s a sign that a secure connection has been established through a process known as the TLS handshake. In this blog post, we’ll thoroughly explore the steps involved in this crucial mechanism that secures your data as it travels over the internet.

If you’re a visual learner, you may find this helpful infographic here to reference as we dive deeper into the TLS handshake process.

Preface

Before we delve into the handshake specifics, it’s essential to understand the two primary objectives of SSL/TLS:

✅ Verify the identity of the server.
✅ Establish session keys to safeguard data during transmission.

Key Concepts

In order to grasp the intricacies of the TLS handshake, it’s beneficial to be familiar with certain cryptographic principles:

Hashing
Message Authentication Codes (MACs) and Hash-based MACs (HMACs)
Encryption

We won’t undertake a detailed exploration of these concepts here. Instead, we’ll maintain our focus on the handshake itself, but feel free to check out the linked resources for clarification.

Now, let’s break down the steps of the TLS handshake in detail:

Step 1: Client Hello

The handshake begins when your web browser, referred to as the Client, sends a “Client Hello” message.

This message includes five critical elements:

SSL Version
Random Number
Session ID
Cipher Suites
Extensions

Each of these components plays a vital role in the handshake process.

Detailed Breakdown

SSL Version:
The Client specifies the highest version of SSL it supports, such as SSL 3.0, TLS 1.0, TLS 1.1, TLS 1.2, and so on. The Server will then respond with its supported version, and both parties agree on the highest common version.
Random Number:
The Client generates a 32-byte random value, contributing to the final session keys that will secure the communication between the Client and the Server. This randomness enhances the cryptographic strength of the session keys.
Session ID:
This feature allows the Client