Understanding the TLS Handshake: Securing Your Online Connections 🔒

When you visit a secure website, you might notice the familiar padlock icon in the address bar. But have you ever wondered what happens behind the scenes to make that lock click into place? In this post, we’ll explore the intricate process of the TLS (Transport Layer Security) handshake, which ensures a secure connection between your browser and the server you’re accessing.

To enhance your understanding, I recommend opening an accompanying infographic that visually represents the various messages exchanged during a TLS session. You can find the image here.

(Disclaimer: Image source is from a Twitter thread. The link is provided at the end of this post.)

Introduction to TLS Handshake

The primary objectives of SSL/TLS are twofold:

• ✅ Authenticate the identity of the server.
• ✅ Establish session keys to encrypt the data during transfer.

Before diving into the specifics of the handshake process, let’s clarify some key concepts.

Key Concepts to Grasp

1. Record versus Packets

In the context of the TLS handshake, the term “Record” describes a unit of communication. Importantly, a Record is not synonymous with a Packet; multiple Records can be contained within a single Packet, or a single Record may span several Packets.

2. Essential Cryptographic Concepts

To fully appreciate the TLS Handshake, familiarity with certain cryptographic terms is beneficial:

• Hashing
• MACs and HMACs
• Encryption

While we won’t delve deeply into these concepts here, I encourage you to explore the provided links for more information.

Step 1: Client Hello

The handshake process commences with a Client Hello message sent from your web browser. This message includes five critical components:

1. SSL Version
2. Random Number
3. Session ID
4. Cipher Suites
5. Extensions

Each of these elements plays a significant role in establishing a secure connection.

SSL Version

The Client indicates the highest version of SSL/TLS it supports