The TLS Handshake Explained with Example (the Math)

Transport Layer Security is the protocol used to encrypt the Internet.

The goal of TLS is to agree on the same key between parties that will be used to encrypt the traffic. In this video I will explain how the TLS handshake happens.

The client starts the handshake by generating 3 numbers, g and n which are public and x which is private.

The client sends g, n and parameter g raised to the power x modulo n. It is very difficult for anyone sniffing to extract x from this parameter.

The server receives the client hello and generates a private number y.

The server then raises the client’s parameter to the power of y and does a modulo of n and with basic math this is equal to g to the power x multiplied by y module n, this now becomes the key.

The server sends its hello with g raised to the power of y modulo n, again very hard to extract y from this. Server also sends many other information here such as certificates.

the client raises server parameter to the power of x which equates to g to the power x multiplied by y module n.

Both the client and server has the same key, this key exchange algorithm is called diffie hellman

Let us go through an example to explain this. client generates g is 10, n is 7 and x which is the private number as 2, the client calculates its parameter by raising 10 to the power of 2 module 7 resulting in 2.

The client sends its parameter 2, along side g and n

The server receives the parameters, calculates its private number y as 3. Server raises client parameter 2 to the power of 3 module 7 which results in the 1 that is the key.

Server sends its parameter which is g to the power of y module n which results in 6

Client raises server parameter 6 to the power of 2 module 7 which results in the 1 . It is very important to have n as large number in classical diffie hellman key exchange but this is not case with eliptic curve diffie hellman key exchange

The client and server hellos have lots of other information as well, such as the type of cipher algorithm to use which is fed the number they just agreed upon, certificates, TLS extensions and more! We demonstrated TLS 1.3 in this video TLS 1.2 has an extra round trip.

If you are interested in more details check out the playlist in the card where I made many videos on TLS. Let me know if you like those short engineering videos by hitting Like & Subscribe, I also make long form content so make sure to check out the other content of the channel! thank you (L)

🎙️Listen to the Backend Engineering Podcast

🏭 Backend Engineering Videos

💾 Database Engineering Videos

🏰 Load Balancing and Proxies Videos

🏛️ Software Archtiecture Videos

📩 Messaging Systems

Become a Member

Support me on PayPal

Join our Thriving Backend Community on Discord

Stay Awesome,
Hussein

[dominiquekostler]

Just found your channel and I'm amused by your explanation style. There was one thing that I would like to point out in this video regarding the values used in the DIffie Hellmann exchange. The generator (g) needs to be a prime number, using10 as an example is actually incorrect. But the steps are obviously right, this is just a pedantic remark :) Keep up the good work.

[hnasr]

Well, previous video was a disaster even I couldn’t understand how I sounded like a chipmunk. So here is round 2, 5 times longer.

[KhajaMD]

That's one way to respond to feedback or criticism. 👍

[manishbhatt]

Wow I was just studying Diffie-Hellman key exchange and this was good to know as well. Brilliant explanation. Thanks!

[DedicatedManagers]

Great video! I actually watched the computerphile version of this and I didn’t understand it. I don’t think they showed that last part of the equations where the exponents are the same, so I didn’t get how the shared key was finally formed.

Your explanation was very simple. Thank you.

[erikslorenz]

Your stuff is just the best. I think I've watched like 20 hours of them over the past couple weeks. I nerded out hard this weekend and fiddled with all the different proxies haha. Still love me some haproxy!!

[alexguillen]

You should do a video on lattice based cryptography. You seem like someone who can explain it thoroughly!!

[arishrehmankhan]

You make me understand a very complex topic in a easy way. Thanks a lot.

[pratimmoulik]

This is much easier than the lecture notes that I have. At least you show the math behind it.

[acommenter]

Better work than my professor. Nice job!

[Naveenbabuborugadda]

Nice explanation. I like maths because of this.

[savithadatchu]

Your videos are so informative. Thanks a lot

[danielricaud]

Great content, short and sweet! Thanks Hussein!

[vrushabhpatil]

thanx for give such good explaination and reference

[Kekszmester]

You are the best BE content maker. GOAT !

[abhisheksengupta]

Hi Hussein, I am a great fan of your Advanced SQL Videos.. I want to understand more on Different Isolation Levels.Can you pls make videos on it ?
I keep getting confused by seeing there differences in answers posted on Stackoverflow related to FOR READ and other types of locking mechanisms .

[danielskrypnik]

Thank you for this explanation.
I watched your video about certificates (Whar are ssl/tls certificates? Whay do we need them?) and your video about tls 1.2 and 1.3. There are a couple questions.
Where do actually certificates come to the play? In the video about certificates you said that server must send its public key to the CA server. What is public key in the case of 1.3 tls and diffie-hellman key exchange? [g^y] % n or maybe something else?

I am just trying to provide some "normalization" of my knowledge.
Thanks.

[oscardeb]

Can't we get a total video on how to become a complete backend engineer in this new year??

[Rafael-zcxy]

Great explanation! I'd like to know if this symetric secret key is the AES key used on Https traffic...I still don't know the relation between diff hellman and AES on TLS....

[isaacambi]

Please do you have any DevOps projects explained in details from beginning to end. Most of the ones I see on YouTube, I am not able to follow.