Understanding the TLS Handshake: Securing Your Online Experience

When you browse the web and see that reassuring padlock icon 🔒, you might not realize the intricate steps taken to ensure your connection is secure. In this blog post, we’ll delve into the details of the TLS (Transport Layer Security) handshake, the behind-the-scenes process that protects your data as it travels between your web browser and the websites you visit.

It might help to have a visual reference handy as we explore this topic. An informative infographic depicting the different messages exchanged during a TLS session can be found here. I recommend opening it in a separate tab for easier follow-up.

Introduction

The primary objectives of SSL/TLS protocols can be summarized as follows:

• ✅ Verifying the identity of the server
• ✅ Establishing session keys to safeguard the data being transferred

Before we unpack the TLS handshake process, let’s clarify two important points:

Distinguishing Records from Packets

In the context of the TLS handshake, each entry in the aforementioned infographic represents a “Record.” It’s crucial to note that a Record is distinct from a Packet. A single Packet can contain multiple Records, and conversely, multiple Packets may be necessary to convey one Record.

Cryptographic Foundations

To fully appreciate the TLS handshake, it’s helpful to have a basic understanding of key cryptographic concepts such as:

• Hashing
• MACs and HMACs
• Encryption

We won’t delve deeply into these concepts here, allowing us to concentrate on the handshake itself.

Step 1: Client Hello

The handshake begins with the Client, your web browser, sending a Client Hello. This message comprises five crucial fields:

• SSL Version
• Random Number
• Session ID
• Cipher Suites
• Extensions

Each of these elements plays a vital role in achieving the handshake’s objectives.

SSL Version

The Client transmits the highest SSL version it supports, such as SSL 3.0, TLS 1.0, TLS 1.1, or TLS 1.2.