Decoding TLS v1.2 Protocol Handshake With Wireshark


We are not just explaining how the TLS v1.2 handshake protocol works, but we will also decode the TLS v1.2 protocol handshake using Wireshark. There are two main goals of this article: (1) Explaining the TLS v1.2 handshake protocol step by step. (2)Capture and examine a TLS stream in Wireshark.

Just for demonstration purposes, we are going to access Pluralsight’s (public learning platform) website on the chrome browser over a secured HTTPS connection. Because TLS handshake works only in HTTPS communication. The difference between HTTP and HTTPS is that in HTTP, only a TCP handshake will happen, but in the case of HTTPS TCP and TLS, both handshakes will happen.

TCP Three-Way Handshake Protocol:

In HTTP, the TLS handshake will happen after the completion of a successful TCP handshake. TCP handshake process is a separate topic, so we are not covering that in this article. To tell in short, a TCP handshake is a three-step process. First, the client sends the SYN packet to the server. Second, the server sends SYN + ACK in response to the client. At last, the client sends the acknowledgment to the server.

An image of TCP three-way handshake
TCP three-way handshake

192.168.0.114 is the client machine. 199.38.167.35 is the destination Pluralsight.

An image of the source and destination IP address used in this demo
The source and destination IP address used in this demo

TLS v1.2 Protocol Handshake:

Once the TCP three-way handshake is done. The TLS handshake will kick in with client hello.

Step #1: Client Hello

An image to start a TSL handshake with 'Client Hello'
The first step to start a TSL handshake with ‘Client Hello

The client sends a client hello message to the server. In the client hello message client sends its supported TLS version, UTC time, 28-byte random number, session ID, URL of the server, and supported cipher suites to the server.

An image of 'Client Hello' details captured in Wireshark
Client Hello’ details captured in Wireshark

If you look at Wireshark, you will see a client hello packet right after the three-way handshake. You can also see the TLS version, 28-byte random number, all supported cipher suites, and session ID in the packet.

See also  Learn Ethical Hacking for Free with SkillsForAll

Step #2: Server Hello

After the server receives the client hello, it will examine the supported TLS versions and cipher suites sent by the client. And the server will select the highest supported TLS version by both client and the server. The server also includes the session ID, UTC time, 28-byte random number, and selected cipher suite in the server hello message and sends it to the client.

An image of 'Server Hello' - in response to the 'Client Hello'
Server Hello’ — in response to the ‘Client Hello

Wireshark Demo:

An image of 'Server Hello' details captured in Wireshark
Server Hello’ details captured in Wireshark

The next packet you will see after client hello is server hello.

Step #3: Certificate, Server Encryption Key, and Server Hello Done

An image of  Sending Certificate, Server Encryption Key, Server Hello Done to the client
Sending Certificate, Server Encryption Key, Server Hello Done to the client

After sending the server a hello message. The server will send the certificate, which has p and g values used in the key exchange process, server encrypted key, and server hello done message to the client.

An image of Sending Certificate, Server Encryption Key, Server Hello Done to the client in Wireshark
Sending Certificate, Server Encryption Key, Server Hello Done to the client in Wireshark

Step #4: Client Encrypted Key, Change Cipher Spec, and Finished

An image of receiving client encrypted key, change cipher spec, and encrypted handshake message from client
Receiving Client encrypted key, change cipher spec, and encrypted handshake message from client

After the client receives the server encrypted key. It will respond with the client encrypted key. It also sends change cipher spec. What it means is that it has enough information to start encrypted communication, and it is going to send the data with encryption from now onwards. Till now, the communication was plain text. After this, communication will happen with encryption. After the server receives the change cipher spec message, it expects encrypted data from the client.

 

See Also How To Protect Your Android Device From The New DawDropper Banking Dropper?

An image of receiving client encrypted key, change cipher spec, and encrypted handshake message from a client in Wireshark
Receiving Client encrypted key, change cipher spec, and encrypted handshake message from a client in Wireshark

Step #5: Change Cipher Spec And Finished

An image of the final step in TLS handshake - sending change cipher spec and the final handshake message to the client
The final step in TLS handshake — sending change cipher spec and the final handshake message to the client

This is going to be the last message that the server is going to send, which includes change cipher spec and finishing the message. This indicates that all feature messages are going to be encrypted.

See also  What is New in KB5030211- September Cumulative Update for Windows 10 Version 22H2 and 21H2?
An image of the final step in TLS handshake - sending change cipher spec and the final handshake message to the client in Wireshark
The final step in TLS handshake — sending change cipher spec and the final handshake message to the client in Wireshark

This completes the process of the TLS v1.2 protocol handshake process.

Leave a Reply

Your email address will not be published. Required fields are marked *