2016-08-02

In his blog post, 'The First Few Milliseconds of an HTTPS Connection', Jeff Moser does a wonderful job of walking through the TLS/SSL handshake process, and explaining what is happening on the client side, what is happening on the server side, and what is going over the wire during each step of the process.

But, being that the post was written in 2009, the article describes the process using TLS 1.0 with the TLS_RSA_WITH_RC4_128_MD5 cipher suite. Of course, TLS 1.0 with this cipher suite is now considered to be deprecated.

I'm interested in seeing a similar walk-through based on SSL/TLS protocols and cipher suites that are considered to be secure today (preferably with perfect forward secrecy) - e.g. TLS 1.2 with TLS_ECHDE_RSA_WITH_AES_128_GCM_SHA256. I've done a fair bit of Googling, but have come up empty. Would anyone on here be able to point me to such an article? If not, would anyone on here be interested in taking a crack at writing one?

Show more