Understanding the TLS Handshake: Unlocking the Secrets Behind Your Secure Connection 🔒

When you browse the internet, every time you connect to a website secured with HTTPS, you may notice a little padlock symbol. This indicates a secure connection, but what lies beneath that layer of security? In this post, we’ll explore the intricacies of the TLS Handshake, the series of exchanges that ensures your connection is safe and encrypted.

To aid our discussion, I recommend keeping this infographic open in another tab as we break down the process.

Preface: The Dual Goals of SSL/TLS

Before delving into the handshake itself, it’s essential to acknowledge the primary objectives of the SSL/TLS protocol:

• Authentication: Verifying the server is indeed who it claims to be.
• Encryption: Establishing session keys that secure the data exchanged between the client and server.

Key Concepts: Records vs. Packets and Cryptography Basics

To fully grasp the TLS Handshake, it’s important to differentiate between “Records” and “Packets.” Notably, each record in the handshake may not correspond directly to a single packet, as multiple records can fit within a single packet and vice versa.

Additionally, a basic understanding of concepts like Hashing, MACs, HMACs, and Encryption is beneficial. While we won’t dive deeply into these topics here, you can find helpful resources in linked videos provided.

The TLS Handshake Process

1️⃣ Client Hello

The handshake begins with the Client Hello message, sent by your web browser. This message includes several critical fields:

• SSL Version
• Random Number
• Session ID
• Cipher Suites
• Extensions

Each of these elements plays a crucial role in the overall handshake process.

SSL Version

The client indicates the highest SSL/TLS version it supports, facilitating a subsequent agreement on the mutual version to be used.

Random Number

A 32-byte random number is generated by the client, contributing much-needed entropy to the session keys.

Session ID

This field allows for “Session Resumption” in which the client can request a shortened handshake based on an earlier session.

Cipher Suites

The client presents a list of supported cipher