Understanding the TLS Handshake: Securing Your Online Connections

The digital world thrives on secure connections, and if you’ve ever visited a website, you may have noticed that reassuring padlock icon in your browser’s address bar. This symbol indicates that your connection is secure, thanks to the Transport Layer Security (TLS) handshake process. In this post, we’ll go through the intricate steps involved in establishing a trusted connection between your browser (the client) and the website’s server, culminating in that coveted padlock.

Why It Matters

The primary objectives of TLS are twofold:

• Authentication: Ensuring that the server you are connecting to is indeed the one it claims to be.
• Encryption: Creating session keys for safeguarding the data exchanged during your browsing session.

Before diving into the handshake process itself, let’s clarify a couple of key concepts that will appear in our discussion:

Records vs. Packets

When exploring the TLS handshake, keep in mind that a “Record” is not synonymous with a “Packet.” Multiple records can reside within a single packet, or conversely, a single record may span multiple packets.

Cryptographic Foundations

A basic understanding of certain cryptography concepts will help you grasp the TLS handshake better:

• Hashing
• Message Authentication Codes (MACs) and Hashed Message Authentication Codes (HMACs)
• Encryption

We won’t delve deeply into these topics here, so if you’re unfamiliar with them, feel free to seek out additional resources.

With that context, let’s unpack the various stages of the TLS handshake.

Step 1: Client Hello

The handshake kicks off with the client (your browser) sending a “Client Hello” message, which encompasses five critical fields:

• SSL Version
• Random Number
• Session ID
• Cipher Suites
• Extensions

SSL Version

The client indicates the highest version of SSL/TLS it supports. The server responds with the highest mutually supported version, typically TLS 1.2 or TLS 1.3 in modern applications.

Random Number

Here, the client generates a unique 32-byte random number that will contribute to the final session keys. This element introduces additional randomness, or “entropy,” enhancing security.

Session ID

The client may request session resumption by sending a session ID. In our case, we’ll proceed with a full handshake, not utilizing session