Part 2 - Behind HTTPS

5 min readApr 6, 2022

In Part-1 I’ve explained why we use HTTPS to HTTP and evolution of TLS from SSL, Please go through that before reading this…

In this article we’ll see things that make HTTPS standout from HTTP[a insecure one].

Things to be considered:

There are few things we need to consider to have an encrypted communication in TLS.

1.What are ciphers ?

First and fore most thing we should do is , we should agree with what kind of encryption algorithm we are going to use to understand each others messages.

This is crucial beacuse certain versions of TLS uses certain ciphers, so as long as we and the server have one of those in common, we can make the communication possible.

If one party is using ARIA algorithm and the other is using AES, the communication will be impossible.

2.Secret Key:

Then we need to have some kind of secret key to do key exchange.

3. Authentication:

Then we have some kind of authentication.
Here it is demonstrated whether one of the parties is who they claim to be, it’s often the server or the site that is visited.
We Should know whether the person we are communicating with is really who they say they are.
Public key will be playing a role in this step.

4.Robust:

Here it should be robust to attacks like MITM, replay attack , downgrade attacks etc…

These four things happen in the beginning of the TLS handshake which we’ll see in sometime.

Cipher Suite:

Here i managed to view the TLS session that has been established with a site.
And it is giving us some infomation related to encryption.

Above we can see some techinal details which is stream representation of all the things that are going to happen during a TLS handshake.

This stream representation is called the cipher suite.

After further investigation, public key information is found.

TLS Handshake:

A TLS handshake is a negotiation between two parties on a network — such as a browser and web server to establish the details of their connection.

The above is the pictorial representation of TLS Handshake.

The theoritical overview of this can be found here.

Now we can see this negotiation traffic in wireshark to understand it further:

Above is the traffic after loading the wikipedia page and filtering it’s IP in wireshark.

The first 3 traffic negotiation is known as TCP 3 way Handshake.

In the above image, we can see the communction is happening in TLS version 1.3 .

Here we can see, the client is telling the server that it supports these 16 Cipher suites and it is telling the server to choose any one among the 16 Cipher suites.

Here the server has choosen a cipher suite and has sent a response as server hello.

Elaboration of the above cipher suite:

In the above image we can see a traffic mentioning Change Cipher Spec.
Here the server and the client starts to encrypt their message using the above negotiated cipher method , in this case it’s CHACHA20 and transfer data.
While going through the authentication using digital signatures, we’ll see the decrypted TLS traffic.