TLS From First Principles

Part I: The Problem

Why encryption exists and what TLS promises to solve.

• 1Sending Secrets Over a Public Network
• 2What Happens When You Type https://
• 3The Three Promises

Part II: The Crypto Toolbox

The building blocks: hashing, encryption, key exchange, and signatures.

• 4Hashing and Data Integrity
• 5Symmetric Encryption
• 6The Key Distribution Problem
• 7Asymmetric Encryption and Key Pairs
• 8Diffie-Hellman: Agreeing on a Secret in Public
• 9Digital Signatures
• 10RSA, ECDSA, and EdDSA

Part III: Cipher Suites Decoded

How the crypto tools combine into the negotiated algorithms for each connection.

• 11What Is a Cipher Suite?
• 12Key Exchange and Forward Secrecy
• 13Authentication in Cipher Suites
• 14Bulk Encryption: AES-GCM and ChaCha20
• 15Hashing in Cipher Suites
• 16Choosing Cipher Suites

Part IV: The TLS 1.2 Handshake

Every message in the handshake, what it contains, and why it's needed.

• 17TLS Records: How Data Is Framed
• 18The Full TLS 1.2 Handshake
• 19The Ephemeral Diffie-Hellman Handshake
• 20Session Resumption
• 21Mutual TLS
• 22TLS Extensions: SNI, Session Tickets, ALPN

Part V: TLS 1.3

What changed, why it was necessary, and how the new handshake works.

• 23Why TLS 1.3 Was Necessary
• 24The 1-RTT Handshake
• 25The TLS 1.3 Key Schedule
• 26PSK and Session Resumption in TLS 1.3
• 270-RTT: Speed vs Security
• 28TLS 1.3 Extensions
• 29Middleboxes and Migration Pain

Part VI: Attacks and Why They Worked

How real attacks exploited TLS weaknesses, and what was fixed.

• 30Man-in-the-Middle, Downgrade, and Replay
• 31Heartbleed, POODLE, BEAST, and CRIME

Part VII: The Quantum Horizon

Why quantum computers threaten TLS and what's being done about it.

• 32What Quantum Means for TLS

Part VIII: Interview Questions

• 33TLS Interview Questions