The TLS Handshake, Step by Step
The TLS handshake is the negotiation that sets up a secure channel before a single byte of application data flows. In a fraction of a second, two strangers agree on how to encrypt, verify each other, and derive a shared secret no eavesdropper can learn. Understanding it demystifies most of applied TLS.
What happens, step by step?#
A modern TLS 1.3 handshake, simplified:
- ClientHello — the client offers supported versions, cipher suites, and its key-share for ephemeral key exchange.
- ServerHello — the server picks the parameters, sends its own key-share, and its certificate.
- Key agreement — both sides combine their key-shares (ECDHE) to derive the same shared secret independently, without ever sending it.
- Verification — the client validates the certificate chain up to a trusted root (PKI); both confirm the handshake was not tampered with.
- Finished — encrypted application data begins.
The crucial trick is step 3: through asymmetric key exchange, both parties compute the same secret from public values, giving them a shared symmetric key an eavesdropper cannot derive — and, because the keys are ephemeral, perfect forward secrecy.
How did TLS 1.3 improve it?#
| TLS 1.2 | TLS 1.3 | |
|---|---|---|
| Round trips | 2 | 1 (0 for resumption) |
| Key exchange | RSA or DHE | Ephemeral only (forward secrecy) |
| Weak ciphers | Present | Removed |
The handshake is where TLS’s guarantees are established. More at the Network Security hub.
Frequently asked questions#
What happens during a TLS handshake?
The client and server agree on a protocol version and cipher suite, the server proves its identity with a certificate, and both sides use ephemeral key exchange to agree on a shared secret without transmitting it. That secret then keys the symmetric encryption used for the rest of the session. All of this happens before any application data is sent.
How did TLS 1.3 speed up the handshake?
TLS 1.3 reduced the handshake from two round trips to one by streamlining the negotiation and removing legacy options, and it added an optional 0-RTT mode for resumed connections. It also mandated forward-secret key exchange, dropping the older, slower, and less secure RSA key transport.