The SSLTLS handshake process

As it goes with all handshakes, the SSL/TLS Handshake is where it all starts. The SSL/TLS handshake involves a series of steps through which both the parties — client and server, validate each other and start communicating through the secure SSL/TLS tunnel.

The reason it’s called a handshake is that it’s when two parties — client and server come across each other for the first time. The handshake involves a number of steps that start from validating the identity of the other party and concludes with the generation of a common key — secret key if you may call it.

Fundamentally, the SSL handshake is nothing but a conversation between two parties (client and server) wanting to accomplish the same purpose — securing the communication with the help of symmetric encryption.

Imagine this handshake process as a dialog between the two.

Let’s see how it goes.

Client: “Hello there. I want to establish secure communication between the two of us. Here are my cipher suits and compatible SSL/TLS version.”

Server: “Hello Client. I have checked your cipher suits and SSL/TLS version. I think we’re good to go ahead. Here are my certificate file and my public key. Check ’em out.”

Client: “Let me verify your certificate. (After a while) Okay, it seems fine, but I need to verify your private key. What I’ll do is, I will generate and encrypt a pre-master (shared secret key) key using your public key. Decrypt it using your private key and we’ll use thing master key to encrypt and decrypt the information”

[Now that both the parties know who they’re talking to, the information transferred between them will be secured using the master-key. Keep in mind that once the verification part is over, the encryption takes place through the master-key only. This is symmetric encryption.]

Client: “I’m sending you this sample message to verify that our master-key works. Send me the decrypted version of this message. If it works, our data is in safe hands.”

Server: “Yeah, it works. I think we’ve accomplished what we were looking for.”

The SSLTLS handshake process

Comments

More from this blog

AWS Network Security Services cheat sheet

How to remove info from Google search?

WhatsApp Proxy // Use //Risk

Palo Alto and Panorama — Hardening the Configuration

Ransomware Attack & Prevention: Everything You Need To Know

Command Palette

Comments

More from this blog