SSL/TLS: How TLS Works

TLS (Transport Layer Security) encrypts communication between client and server. SSL is the predecessor — it's deprecated. When people say "SSL" today they mean TLS. Current versions: TLS 1.2 (still common) and TLS 1.3 (recommended, faster).

TLS Handshake (TLS 1.3)

TLS 1.3 — 1-RTT handshake (1.2 needed 2 RTTs):

Client → Server:  ClientHello
  - TLS version supported
  - Cipher suites supported (e.g. TLS_AES_256_GCM_SHA384)
  - Client random (nonce)
  - Key share (public key for key exchange, e.g. X25519)

Server → Client:  ServerHello + Certificate + CertificateVerify + Finished
  - Chosen cipher suite
  - Server random
  - Server's key share
  - Certificate chain (server identity proof)
  - Signature over handshake (proves server owns private key)
  - Finished (MAC over entire handshake — detects tampering)

Client → Server:  Finished
  - Client verifies certificate chain
  - Client verifies CertificateVerify signature
  - Derives same session keys using key shares + randoms
  - Sends Finished

→ Encrypted application data flows both ways

Key exchange: Diffie-Hellman (ECDHE) — client and server each contribute
  a key share; session key derived from both. Neither side sends the key.
  Forward secrecy: compromise of server private key doesn't expose past sessions.

Cipher Suites

TLS_AES_256_GCM_SHA384 (TLS 1.3)
  ^^^                                    — key exchange always ECDHE in TLS 1.3
      ^^^^^^^^^^^                        — AES-256-GCM: bulk encryption (AEAD)
                   ^^^^^^                — SHA-384: HKDF hash for key derivation

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (TLS 1.2)
  ^^^  ^^^^^  ^^^  ^^^^^^^^^^^^^^^  ^^^^^^
  |    |      |    |                Hash for PRF
  |    |      |    Bulk cipher (AEAD)
  |    |      Auth algorithm (server cert type)
  |    Key exchange
  Protocol

Good suites (TLS 1.2):
  ECDHE-RSA-AES256-GCM-SHA384
  ECDHE-ECDSA-AES256-GCM-SHA384

Avoid:
  RC4 (broken)
  3DES (SWEET32 vulnerability)
  CBC mode without Encrypt-then-MAC (POODLE, BEAST)
  NULL cipher suites (no encryption)
  EXPORT cipher suites (deliberately weakened — FREAK, LOGJAM)

TLS 1.3 vs TLS 1.2

• TLS 1.3: 1-RTT handshake (vs 2-RTT in 1.2) — measurably faster, especially on mobile

• TLS 1.3: 0-RTT resumption — send data with first packet (replay attack risk; use only for safe GETs)

• TLS 1.3: forward secrecy mandatory — ECDHE always used, static RSA key exchange removed

• TLS 1.3: removed weak algorithms — no RSA key exchange, no CBC, no RC4, no SHA-1

• TLS 1.2: still widely needed for compatibility with older clients/servers

• Minimum today: TLS 1.2. TLS 1.0 and 1.1 are deprecated (RFC 8996, 2021). Browsers show warnings.