Phase-1: Deciding which version of the Protocol to use.The system decides which protocol to use. Client and Server exchange hello-packets with each other to confirm. In this IP session, cipher suite, and Agree on which version of the protocol to use.
Phase-2: Server sends his certificate and Server-key-exchange. The server end phase-2 by exchanging the hello packet.
Phase-3: Verification,in this phase, the Client replies to the server by sending his certificate and Client-exchange-key.
Phase-4: In this phase, the Change Cipher suite is passed and all the verifications and security checks are done after this Handshake Protocol ends.
Importance of TLS/SSL Handshake
The server proves its identity to the client using a digital certificate issued by a trusted Certificate Authority (CA).
It allows the client and server to securely exchange cryptographic information without exposing it to attackers.
Both sides agree on the encryption algorithms and security parameters that will be used during communication.
A shared session key is generated, which is later used to encrypt and decrypt the data exchanged during the session.
Components of TLS Handshake
The TLS handshake involves several key components that work together to establish a secure and encrypted communication between the client and the server.
Client: The client is the user’s device that initiates the connection and sends a request to the server.
Server: The server is a remote system that hosts the website or service and responds to the client’s request during the handshake process.
Digital Certificate: Issued by a trusted Certificate Authority (CA), it is used by the server to prove its identity to the client and establish trust.
Cipher Suite: A set of cryptographic algorithms that define how encryption, key exchange, and message authentication will be performed during communication.
Session Key: A symmetric key generated during the handshake, used to encrypt and decrypt data exchanged between the client and server.
Steps in the TLS/SSL Handshake
A secure connection is established by the client and server during the TLS handshake. Here are the main steps :
1. ClientHello: This is where the client begins its handshake with a "hello" message sent to a server, which includes supported encryption methods as well as other parameters.
2. ServerHello: In response, the server also sends its own hello message, selecting an encryption method before sending over its digital certificate for authentication.
3.Authentication: To prove its identity, the server presents a digital certificate. Then it is up to the client to verify if such a certificate is from a trusted source.
4. Key Exchange: In this step, both client and server agree on a shared symmetric key that will be used for client data encryption/decryption during their session. It may involve Diffie-Hellman key exchange or other ways.
5. Session Key Generation: Both sides can use these exchanged keys to generate session keys that will be used for encryption/decryption of data while they are in session.
6. Secure Communication Begins: Once the handshake is completed, the client and server start exchanging encrypted data.
SSL vs TLS
SSL (Secure Sockets Layer)
TLS (Transport Layer Security)
SSL is the older cryptographic protocol used to secure communication over the Internet.
TLS is the successor to SSL and provides improved security.
Developed by Netscape in the 1990s.
Developed by the Internet Engineering Task Force (IETF).
SSL versions include SSL 2.0 and SSL 3.0, which are now deprecated.
TLS versions include TLS 1.0, TLS 1.1, TLS 1.2, and TLS 1.3.
Provides weaker encryption and security mechanisms compared to TLS.
Provides stronger encryption and enhanced security features.
SSL is no longer considered secure and is not used in modern systems.
TLS is widely used today for securing web communication such as HTTPS.
Cipher Suite
A Cipher suite is a set of encryption rules that decides how the TLS handshake works. TLS/SSL protocols use some algorithms from a cipher suite to generate keys and encrypt information so that the communication is end-to-end encrypted. A cipher Suite specifies one algorithm for each of the following tasks
