Understanding the TLS Handshake: Unlocking the Mystery Behind the Secure Padlock 🔒

As you navigate the internet, you might have noticed a small padlock icon in your web browser’s address bar when visiting secure websites. This symbol indicates that your connection is protected by TLS (Transport Layer Security). But what exactly goes on behind the scenes to ensure this security? In this post, we will delve into the intricate process of the TLS handshake — an essential part of establishing a secure connection between your web browser and the websites you visit.

To aid in our exploration, I recommend keeping an infographic handy that illustrates the various steps of the handshake process. You can find it here.

Overview: The Purpose of TLS

Before we dive into the details, let’s clarify the two primary objectives of TLS:
– Authentication: Ensuring the server you are connecting to is indeed the legitimate entity it claims to be.
– Data Protection: Establishing session keys that safeguard the data exchanged during your browsing session.

It’s important to note that throughout this write-up, we will discuss “records,” which represent the messages exchanged during the handshake. Records are distinct from packets, as multiple records can be encapsulated within a single packet and vice versa.

Furthermore, a foundational understanding of cryptographic concepts is beneficial, including:
– Hashing
– MACs and HMACs
– Encryption

If you’re not entirely comfortable with these terms, feel free to check out the videos linked above for additional context.

Now, let’s unravel the steps involved in the TLS handshake.

Step 1: Client Hello

The handshake process begins when your web browser (the client) sends a Client Hello message. This message includes five critical fields:
– SSL Version
– Random Number
– Session ID
– Cipher Suites
– Extensions

Each of these components plays a vital role in establishing a secure connection.

SSL Version

The client specifies the highest version of SSL/TLS it supports. The subsequent server response will also include its supported version, and both parties will agree to use the highest mutually supported version. Currently, only TLS