Understanding the TLS Handshake: The Journey to a Secure Connection

When you browse the internet and notice that little padlock icon in your browser, have you ever wondered what steps led to that moment? In this post, we will delve into the intricacies of the TLS Handshake, the essential process that establishes a secure connection between your device and the website you are accessing.

For a visual reference, consider keeping an infographic handy during this read, which illustrates the exchanges that occur between your browser (the Client) and the server hosting the website.

Overview of the TLS Handshake

The primary objectives of TLS (Transport Layer Security) are simple yet crucial:

1. Authentication: Confirming that the server is truly what it claims to be.
2. Session Key Setup: Establishing keys that will secure the data exchanged between the Client and the Server.

Before we dive into the handshake process itself, it’s important to clarify two key concepts:

Records vs. Packets

In the context of the TLS handshake, a “record” refers to the format of the information exchanged. However, records are not synonymous with packets. One packet can encompass multiple records, or several packets may be necessary to transmit a single record.

Basic Cryptography Concepts

Understanding the TLS Handshake requires familiarity with a few fundamental cryptographic terms:

• Hashing
• MACs and HMACs
• Encryption

While this post won’t cover these concepts in depth, you can find valuable resources linked above for further learning.

Now, let’s explore the various records involved in the TLS Handshake step by step.

Step 1: Client Hello

The TLS Handshake begins with the Client sending a Client Hello message. This message includes five critical components:

• SSL Version
• Random Number
• Session ID
• Cipher Suites
• Extensions

Each of these fields plays a vital role in achieving the handshake’s goals.

SSL Version

Here, the Client communicates the highest version of SSL/TLS it can support. The Server will do the same in its response, and both will ultimately agree on the most secure version they both support. Presently, TLS 1.2 and 1.3 are considered the most secure options available.

Random Number

The Client contributes 32 bytes of random data, which will be incorporated into the final session keys, ensuring added randomness known as “entropy.”

Session ID

This identifier is part