Understanding the TLS Handshake: What Happens Behind the Lock Icon 🔒

When you browse the web, the little padlock symbol represents security and trust. But have you ever wondered what processes occur behind the scenes to establish this secure connection? In this blog post, we will dissect the TLS (Transport Layer Security) Handshake, which forms the backbone of secure online communication.

The infographic linked below provides a visual representation of the messages exchanged between your web browser (the Client) and the website’s server during a TLS session:

It’s beneficial to have this image open in a separate tab as we delve into the handshake process.

The Purpose of SSL/TLS

Before we get started, it’s important to highlight the primary goals of SSL/TLS:

• ✅ Verify the authenticity of the Server
• ✅ Establish session keys that ensure secure data transfer

Now, let’s go through the different records that comprise the TLS Handshake.

1️⃣ Client Hello

The TLS Handshake begins when the Client initiates a Client Hello message. This message contains five critical fields:

• SSL Version
• Random Number
• Session ID
• Cipher Suites
• Extensions

Each field plays an essential role in achieving a secure connection.

1️⃣.1 – SSL Version

The Client specifies the highest SSL/TLS version it supports, such as SSL 3.0, TLS 1.0, TLS 1.1, or TLS 1.2. The Server replies with its supported version, and they select the highest common one to establish a secure connection. As of now, only TLS 1.2 and TLS 1.3 are considered secure.

1️⃣.2 – Random Number

The Client generates a 32-byte random value that is mixed into the session keys, adding an element of entropy to enhance security.

1️⃣.3 – Session ID

This is used for “Session Resumption,” allowing clients and servers to bypass heavy cryptographic operations if they are resuming a previous session. However, for this explanation, we’ll assume a full handshake takes place.

1️⃣.4 – Cipher Suites

A Cipher Suite includes algorithms used for Authentication