Understanding the TLS Handshake: Securing Your Online Connection

When you browse the web and see that reassuring padlock icon 🔒 in your browser’s address bar, it signifies a secure connection between you and the website you’re visiting. This article delves into the critical process behind achieving that secure connection: the TLS handshake.

To aid this explanation, you might find it beneficial to refer to this infographic illustrating the key messages exchanged during the handshake: Infographic Here.

The Purpose of the TLS Protocol

Before diving into the mechanics of the handshake, let’s clarify the overarching goals of the TLS protocol, which are twofold:

• ✅ Authenticating the server to ensure it is who it claims to be
• ✅ Establishing session keys to secure the data being transmitted

Key Concepts to Understand

Records vs. Packets

It’s crucial to distinguish between “records” and “packets.” Each message depicted in the infographic refers to a record in the TLS handshake process. A single packet can contain multiple records, or conversely, a single record may require several packets to transmit.

Basic Cryptographic Concepts

A foundational understanding of some cryptographic principles will be useful as we explore the handshake:

• Hashing
• Message Authentication Codes (MACs) and HMACs
• Encryption

While we won’t dive into these topics deeply, familiarizing yourself with them can enhance your comprehension of the handshake process. Feel free to seek out additional resources for these concepts.

Step-by-Step Breakdown of the TLS Handshake

1️⃣ Client Hello

The TLS handshake initiates with the Client (your browser) sending a Client Hello message, which includes several key fields:

• SSL Version
• Random Number
• Session ID
• Cipher Suites
• Extensions

Each of these components plays a crucial role in establishing a secure communication channel.

1️⃣.1 — SSL Version

The Client indicates the highest version of TLS it supports (e.g., TLS 1.2, TLS 1.3). The Server will respond with the highest version both parties can agree on.

1️⃣.2 — Random Number

The Client generates a 32-byte random number, adding a layer of unpredictability to the session keys that will secure the eventual data transfer.