Understanding the TLS Handshake: Unveiling the Secure Connection Process

When browsing the internet, you’ve likely noticed that little padlock icon in your browser’s address bar. But do you know what happens behind the scenes to ensure that your connection to a website is secure and trustworthy? In this blog post, we will delve into the intricacies of the TLS (Transport Layer Security) handshake, demystifying the crucial steps that occur between your web browser and the server hosting the website you’re visiting.

To enhance your understanding, it may be beneficial to refer to this helpful infographic. Please feel free to open it in a separate tab as we explore each stage of the handshake process.

Introduction

At its core, the primary purpose of SSL/TLS is twofold:

• ✅ Confirm the authenticity of the server.
• ✅ Establish session keys that will secure the data transmitted.

Before we dive deeper, let’s clarify two key concepts related to the handshake:

Records vs. Packets

In the infographic, each line corresponds to a “record,” which differs from a packet. Records can span multiple packets and vice versa, as they represent the data exchange during the handshake process.

Cryptographic Fundamentals

To fully grasp the TLS handshake, it’s helpful to understand the following cryptographic principles:

• Hashing
• MACs and HMACs
• Encryption

While we won’t dissect these concepts in detail here, you can explore them through the linked resources if you’re unfamiliar.

Now, let’s unpack the TLS handshake step by step!

Step 1: Client Hello

The process commences with the Client (your web browser) sending a “Client Hello” message containing five critical components:

1. SSL Version
2. Random Number
3. Session ID
4. Cipher Suites
5. Extensions

Each component plays a vital role in establishing a secure connection.

1.1 SSL Version

The Client communicates the highest SSL version it supports, such as SSL 3.0, TLS 1.0, etc. The Server responds by indicating its supported version. They will then agree on the highest version that both can utilize.

Currently, only TLS 1.2 and TLS 1.3 are deemed secure.

1.2 Random Number

The Client generates and transmits 32 bytes of random data, which contributes to the session keys, introducing “entropy” or randomness necessary for encryption.

1.3 Session