The TLS Record Protocol is the core component of TLS responsible for encrypting and integrity-checking data as it moves between devices. It operates within the application layer of a network packet and handles the bulk of secured data transmission.
TLS Record Protocol
TLS is a protocol, and a protocol establishes the rules of communication between two devices. But there are also subprotocols to that protocol, and one of those is the TLS record protocol. The TLS record protocol does the bulk of the work; it really is the encapsulation of the whole thing that makes it secure.
We're going to get into the details of the TLS record protocol, which is once again what does the bulk of the work. Then we'll get into record types and what the different record types are, and then we'll talk about a specific record type, the application data.
Remember, the goal of TLS is to create that authenticity piece, that confidentiality and integrity, and it does that with two primary components: the TLS record protocol, which gives it that confidentiality and integrity, and the TLS handshake protocol, which is that authentication piece and establishes the parameters. Just a reminder, there are different versions, and the main version that we'll be talking about here is TLS 1.3.
Let's take a look at the TLS record layer and see what it looks like. Here we have an IP packet. An IP packet is what traverses the internet; it's what we call layer three. We're not going to get too wrapped up into the OSI layers, but just from a perspective, this is what traverses the internet, and that's considered layer three. Then we have layer four, and at layer four here we have a TCP segment, and there's a lot of cool stuff that happens in this layer four. Then we have the application layer, so this would be similar to — if this was HTTP, then this is where we'd find HTTP. But instead, maybe we're communicating with HTTPS, so at this application layer we actually have a TLS, and then within TLS we have a record layer, and then we have content for that record layer.
One thing to note is we could actually have multiple records within this application layer. The bulk of the data is going to be inside this content. For instance, if we're going to a web page and it's HTTP traffic, then that is going to be what's found inside this content. This content is largely going to be encrypted.
What does that look like? This content layer could be one of four different things — and this is specifically talking about TLS 1.3. It could be a handshake that happens, so the handshake data is within this content. Or it could be application data. Or it could be an alert. Or it can be a change cipher spec.
When TLS is just getting started, it needs to go through what's called a handshake, and so the first couple of messages that we're going to see in this record layer, the content is going to be this handshake. That's going to be for key exchange, it's going to be for negotiating cryptographic parameters, and for that authentication piece.
Most of your content type is going to be application data — it's going to be your encrypted data. So the bulk of your content type is really going to fall under this application data. There actually is another protocol here, the alert protocol within TLS, and so we could find content type in here for some sort of alerting as well. And we will see at times this change cipher spec, and this is used for backwards compatibility, so we'll see that come up as well.
This is a Wireshark capture right here. Wireshark is a program — it's a free program, and it's really cool. What we can do is we can set it up to monitor the traffic coming in and out of our computer, and it gets down into the actual bits, so we can actually see the bits that are being transferred back and forth. However, what we're seeing right here is a better, easier way to interpret the data that's flowing back and forth. Wireshark displays it in such a way that we can pull out certain pieces of information.
We can see the packet right here, the IP packet, which I said is layer three. We can see that right here, and then we could actually open this up and dig down deep into the details of that, like IP source and destination addresses, so it's pretty cool. This is the TCP, or layer 4, segment right here, and so we can see the details of that as well. Within there we have our application layer, so we see the Transport Layer Security, the TLS layer, right there.
Within the TLS we have several records, so here's record one, here's record two, and here's record three. The first one right here is the handshake protocol, so this is going and establishing that initial connection back and forth, and so we see this handshake that's happening — this is the first content, with the handshake. The second one here is a change cipher spec protocol, and then we have an application data protocol, so this is our actual application data right there.
As I mentioned before, the bulk of our data is going to be transferred through this application data, and one reason that is, is because we want our data to be encrypted, and this is where it happens. In fact, we're not going to see any really valuable information in here, because it's all encrypted. There'll be some sort of cipher suite that we're going to specify that will encrypt that data, so in this example right here, maybe we're using AES-256 to do the encryption and send it back and forth. For the integrity piece we have some sort of hash, so maybe we're using SHA-256 as the hash for the integrity part of this.
What we've just solved for with that application data is that now we have confidentiality, because it's encrypted, and we have that integrity, because we're using hashing to verify that that information is not being changed back and forth. We still have not solved, though, that authenticity piece of this.
And we have a new problem. We have the confidentiality and integrity, but we need some parameters — we need to specify how we're going to encrypt things and what hashing algorithm we're going to use. So we've got a new question, and that question is: how do we securely coordinate our cipher suite and keys? That's where the TLS handshake protocol comes into place. That's going to establish those parameters, and also do the authentication piece.
We talked about that TLS record protocol, we also got into record types, and talked about application data and how application data really solves that confidentiality and integrity piece.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →