Transport Layer Security
ActiveCryptographic protocol providing secure communication over computer networks, ensuring privacy, data integrity, and authentication between applications.
In one line
TLS secures internet communication by encrypting data between clients and servers. TLS 1.3 (RFC 8446) reduced handshake latency to 1-RTT (0-RTT for resumption), removed insecure algorithms, and simplified cipher suite negotiation. It protects HTTP (HTTPS), email (SMTPS/IMAPS), and virtually all modern internet traffic through certificate-based authentication and symmetric encryption.
Quick Reference
| Field | Size | Description |
|---|---|---|
| Content Type | 1 byte | Record type: handshake (22), application data (23), alert (21) |
| Version | 2 bytes | Protocol version (0x0303 for TLS 1.2, legacy in 1.3) |
| Length | 2 bytes | Length of the following fragment (max 16384) |
| Fragment | Variable | The actual record data (encrypted in application phase) |
Key Characteristics
Encrypted
All application data encrypted with AES-GCM or ChaCha20-Poly1305.
Authenticated
Server (and optionally client) verified via X.509 certificates.
Fast Handshake
TLS 1.3 completes in 1 round-trip. 0-RTT for returning clients.
Forward Secrecy
Ephemeral Diffie-Hellman ensures past sessions can't be decrypted.
Message Format
TLS 1.3 Handshake (1-RTT):
Client → Server: ClientHello
- Supported cipher suites
- Key share (ECDHE)
- Supported versions: TLS 1.3
Server → Client: ServerHello + EncryptedExtensions
- Selected cipher suite
- Key share
- Certificate + CertificateVerify
- Finished
Client → Server: Finished
[Handshake complete – application data encrypted]