TLS - Dleifnesor/NET-215 GitHub Wiki
This document explains how TLS (Transport Layer Security) provides encryption for HTTPS communication, including a detailed table of the handshake steps and the role of the pre-master secret.
Transport Layer Security (TLS) is a cryptographic protocol that secures communication over a network. It is widely used in HTTPS to protect the confidentiality and integrity of data between a web client and server. TLS uses both:
-
Asymmetric encryption: for secure key exchange
-
Symmetric encryption: for encrypting actual data transferred after the handshake
TLS handshake is the process that establishes a secure connection between a client and a server. Below is a detailed step-by-step breakdown of how it works:
| Step | Action | Description |
|---|---|---|
| 1 | TCP Handshake | Client and server perform a standard 3-way handshake (SYN, SYN-ACK, ACK) |
| 2 | Client Hello | Client sends a message listing supported TLS versions, a random number (R1), and a session ID |
| 3 | Server Hello | Server responds with chosen TLS version, its own random number (R2), and its digital certificate (with public key) |
| 4 | Server Hello Done | Server signals it has completed its part of the handshake |
| 5 | Pre-Master Secret | Client generates a pre-master secret, encrypts it using the server's public key, and sends it to the server |
| 6 | Master Secret Generation | Both client and server derive a master secret using: the pre-master secret, R1, and R2 |
| 7 | Change Cipher Spec & Finished | Both sides confirm cipher spec and exchange 'Finished' messages, encrypted with the derived key |
After this process, the TLS connection is established and symmetric encryption is used to securely exchange data.
The pre-master secret is a randomly generated value created by the client and encrypted using the server's public key. Only the server can decrypt it, ensuring confidentiality.
Once the server decrypts the pre-master secret, both the client and server use it, along with the two random numbers (R1 and R2), to derive the master secret. This master secret is then used to generate the symmetric session keys that will encrypt and decrypt the data during the session.
master_secret = PRF(pre_master_secret, "master secret", R1 + R2)
Where PRF is a pseudo-random function defined by the TLS specification.