Understanding the TLS Handshake: How Your Browser Secures Your Connection 🔒

In this post, we’ll dive into the intricate process that your web browser and the website you’re accessing go through to establish a secure connection. You know that reassuring padlock icon you see in the address bar? It’s the result of a complex procedure known as the TLS handshake.

To help illustrate this process, I recommend keeping an infographic handy, which details the various messages exchanged between the Client (your browser) and the Server (the website) during the TLS handshake. You can view it here.

Now, let’s break down what happens behind the scenes of this highly crucial interaction.

Introduction

The primary objectives of SSL/TLS protocols are twofold:

• ✅ Ensure the Server’s authenticity.
• ✅ Establish session keys to safeguard the data exchanged afterward.

Before we delve deeper, it’s vital to clarify a couple of points:

Records vs. Packets

In the context of the TLS handshake, a “Record” is distinct from a “Packet.” Each line represented in the infographic symbolizes a Record. Multiple Records can fit into a single Packet or one Packet may be split across multiple Records.

Understanding Cryptography

A foundational grasp of several cryptographic concepts will enhance your understanding of the TLS handshake:

• Hashing
• MACs and HMACs
• Encryption

We won’t cover these topics in deep detail here; instead, we’ll focus primarily on the handshake itself. If these terms are new to you, I encourage you to check out additional resources for clarity.

With that context in mind, let’s dissect the records that comprise the TLS handshake:

Step 1: Client Hello

The TLS handshake kicks off with the Client sending a Client Hello message. This message contains five critical fields:

1. SSL/TLS Version
2. Random Number
3. Session ID
4. Cipher Suites
5. Extensions

Each field plays a pivotal role in ensuring a successful TLS handshake.

Client Hello Breakdown

1. SSL/TLS Version

The Client communicates the highest SSL/TLS version it supports, whether that be SSL 3.0, TLS 1.0, TLS 1.1, or `