A brief about SSL/TLS, TCP and UDP

Imagine typing a website address into your browser and instantly receiving a fully loaded webpage. Within seconds, your request travels across the internet, guided by protocols like Transmission Control Protocol (TCP) or User Datagram Protocol (UDP), while sensitive data is protected using Transport Layer Security (TLS).

Although this process happens silently in the background, it forms the foundation of secure communication on the internet. For security testers and application security engineers, understanding these protocols is crucial for analyzing network behavior, identifying vulnerabilities, and ensuring that applications communicate securely.

Understanding TCP

Before diving into secure communication protocols like TLS, it’s important to understand how data is actually transmitted across the internet. One of the core protocols responsible for reliable communication is Transmission Control Protocol (TCP).

TCP is a connection-oriented protocol that ensures reliable, ordered, and error-checked delivery of data between applications over a network. It operates at the Transport Layer (Layer 4) of the OSI Model, which is responsible for end-to-end communication between systems.

Unlike some faster but less reliable protocols, TCP focuses on accuracy and reliability. Before transmitting data, TCP establishes a connection between the sender and receiver, ensuring that both systems are ready to communicate. This makes TCP the preferred protocol for applications where data integrity is critical, such as web browsing, email communication, and file transfers.

Key Characteristics of TCP

✓ Connection-Oriented Establishes connection before data transfer

✓ Reliable Guarantees data delivery

✓ Ordered Data arrives in correct sequence

✓ Error-Checked Detects and retransmits corrupted data

✓ Flow Control Prevents overwhelming receiver

✓ Congestion Control Adapts to network conditions

Working of Transmission Control Protocol (TCP)

Before any data is exchanged between a client and a server, TCP establishes a reliable connection through a process known as the TCP Three-Way Handshake. This mechanism ensures that both systems are ready to communicate and that sequence numbers are synchronized for reliable data transfer.

TCP Three-Way Handshake

Client                                           Server
  |                                                 |
  |                 SYN (Synchronize)               |
  |                    SEQ = X                      |
  |------------------------------------------------>|
  |                                                 |
  |                    SYN-ACK                      |
  |                    SEQ = Y                      |
  |                    ACK = X + 1                  |
  | <---------------------------------------------- |
  |                                                 |
  |                ACK (Acknowledgment)             |
  |                   SEQ = X + 1                   |
  |                   ACK = Y + 1                   |
  |-----------------------------------------------> |
  |                                                 |
     Connection Established – Data Transfer Begins

Step 1: SYN (Synchronize)

The connection process begins when the client initiates communication by sending a SYN packet to the server.

• This packet contains an Initial Sequence Number (ISN), which is a randomly generated value used to track packets within the connection.
• Example: SEQ = X

Once the SYN packet is sent, the client moves into the SYN-SENT state, waiting for a response from the server.

Step 2: SYN-ACK (Synchronize–Acknowledgment)

When the server receives the SYN request, it responds with a SYN-ACK packet.

This response contains:

• The server’s own randomly generated Initial Sequence Number
• Example: SEQ = Y
• An Acknowledgment number confirming receipt of the client’s SYN packet
• Example: ACK = X + 1

At this stage, the server transitions into the SYN-RECEIVED state while waiting for the client’s final confirmation.

Step 3: ACK (Acknowledgment)

Finally, the client sends an ACK packet back to the server to confirm that it received the server’s SYN-ACK response.

• Example sequence number: SEQ = X + 1
• Example acknowledgment number: ACK = Y + 1

Once this step is completed:

• Both the client and server move to the ESTABLISHED state
• The connection is successfully created
• Data transfer can now begin

Why the TCP 3-Way Handshake is Important

Key Purposes

• Synchronization — Both client and server exchange and agree on their Initial Sequence Numbers (ISNs), which helps track packets during communication.
• Reliability — The SYN → SYN-ACK → ACK process confirms that both sides can send and receive data properly.
• Prevents Old Connections — The handshake helps eliminate delayed or stale packets that might still exist in the network.
• Resource Allocation — After the handshake completes, both systems allocate resources and buffers required for the connection.

Common Use Cases of Transmission Control Protocol (TCP)

• HTTP / HTTPS (Ports 80 / 443) Web pages must arrive completely and in the correct order to ensure proper loading and rendering in browsers.
• Email — SMTP, IMAP, POP3 (Ports 25, 143, 110) Email communication requires reliable delivery so that messages are not lost or corrupted during transmission.
• FTP (Ports 20, 21) File transfers depend on accurate and complete data transmission, making TCP ideal for ensuring file integrity.
• SSH (Port 22) Secure remote terminal sessions require reliable and ordered communication to ensure commands and responses are correctly delivered.
• Database Connections (Various Ports) Database operations rely on accurate and ordered queries and responses, which TCP guarantees through its reliable communication mechanism.

TCP is ideal for applications where every piece of data must arrive correctly, such as web pages or file transfers. But consider activities like video streaming, online gaming, or voice calls. In these cases, waiting for lost packets to be retransmitted could cause noticeable delays. Instead of prioritizing reliability, these applications prioritize speed and continuous data flow. To support such scenarios, networks often rely on User Datagram Protocol (UDP)

What is User Datagram Protocol (UDP)?

UDP is a connectionless transport protocol that sends data without establishing a connection between the sender and receiver. Because it skips connection setup and reliability mechanisms, UDP provides faster communication but does not guarantee packet delivery, order, or error correction.

Like TCP, UDP operates at the Transport Layer (Layer 4) of the OSI Model. However, it prioritizes speed and low latency over reliability, making it suitable for real-time applications such as streaming, online gaming, and DNS queries.

Key Characteristics of UDP

⚡ Connectionless No connection setup required

⚡ Fast Low overhead, minimal delay

⚡ Unreliable No guarantee of delivery

⚡ Unordered Packets may arrive out of sequence

⚡ No Flow Control Sender doesn’t wait for receiver

⚡ Lightweight Smaller header, less overhead

CLIENT                          SERVER
          |                                |
          |  Send UDP Datagram              |
          |-------------------------------->|
          |                                |
          |        Data Received            |
          |     (No acknowledgment)         |
          |                                |

   ⚡ No Connection Setup
   ⚡ No Handshake
   ⚡ No Delivery Guarantee

Common Use Cases of User Datagram Protocol (UDP)

• DNS — Domain Name System (Port 53) Used for fast domain name lookups. Queries are small and can easily be retried if a packet is lost.
• Video Streaming (Various Ports) Prioritizes speed and continuous data flow. Occasional packet loss is acceptable compared to delays.
• VoIP — Voice over IP (Various Ports) Used for real-time voice communication where delayed packets are often useless.
• Online Gaming (Various Ports) Requires low latency communication. Missing a packet is usually less noticeable than network delay.
• DHCP — Dynamic Host Configuration Protocol (Ports 67, 68) Enables fast IP address assignment to devices on a network using a connectionless communication method.
• TFTP — Trivial File Transfer Protocol (Port 69) Used for simple file transfers and implements its own basic reliability mechanisms.
• IoT Sensors (Various Ports) Devices send periodic updates with minimal overhead, which helps conserve bandwidth and battery life.

Decision Flow: Which Protocol to Use?

START
                  │
      Is data loss acceptable?
           ┌──────┴──────┐
           │             │
          NO            YES
           │             │
       Use TCP     Is real-time delivery
                        critical?
                    ┌────┴────┐
                    │         │
                   YES        NO
                    │         │
                Use UDP   Is the data small
                          and simple?
                       ┌────┴────┐
                       │         │
                      YES        NO
                       │         │
                 Consider UDP   Use TCP

                Default Choice:
                    Use TCP

So far, we have explored how Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) handle data transmission across networks. However, these protocols do not protect the data itself. To secure sensitive information during transmission, modern applications use Transport Layer Security (TLS), which encrypts communication between systems.

What is SSL/TLS?

Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are cryptographic protocols used to secure communication over a network. TLS is the modern and more secure successor to SSL.

They operate on top of Transmission Control Protocol (TCP) and provide encryption, authentication, and data integrity, ensuring that data transmitted between a client and a server remains private and protected from tampering.

How SSL/TLS Works

The TLS protocol secures communication between a client and a server through a process called the TLS handshake. This process establishes trust and creates a shared encryption key for secure data transmission.

Step 1: Handshake Initiation

• The client (such as a web browser) sends a request to the server to initiate a secure connection.
• The server responds by sending its digital certificate, which contains its public key and identity information issued by a trusted Certificate Authority (CA).

Step 2: Certificate Verification and Key Exchange

• The client verifies the server’s certificate using the trusted Certificate Authority to ensure the server’s authenticity.
• After verification, the client generates a session key and securely sends it to the server using the server’s public key.

Step 3: Secure Communication Established

• The server decrypts the session key using its private key.
• Both the client and server now share the same session key, which is used to encrypt and decrypt all subsequent communication.

Once the handshake is complete, data can be transmitted securely with confidentiality and integrity.

What Transport Layer Security (SSL/TLS) Provides

• 🔐 Encryption Data is encrypted during transmission so that unauthorized parties or eavesdroppers cannot read it.
• ✓ Authentication Verifies that the client is communicating with the legitimate server using a trusted digital certificate issued by a Certificate Authority (CA).
• 🛡️ Integrity Ensures that the data has not been modified or tampered with while in transit.
• 🔑 Key Exchange Securely establishes shared encryption keys between the client and server for protected communication. Practical Examples of How TCP, UDP, and TLS Work Together

Understanding how Transmission Control Protocol (TCP), User Datagram Protocol (UDP), and Transport Layer Security (TLS) work in real-world applications helps clarify their roles in modern networking.

Practical Examples of How TCP, UDP, and TLS Work Together

Example 1: Loading a Website (HTTPS)

When a user visits a secure website, multiple protocols work together to establish a reliable and encrypted connection.

User action: [https://www.example.com](https://www.example.com)

Step 1: DNS Lookup (UDP)

• The browser sends a query to a DNS server asking for the IP address of the domain.
• Example request: “What is the IP address of example.com?”
• The DNS server responds with the IP address (e.g., 93.184.216.34).

Step 2: TCP 3-Way Handshake Before any data is exchanged, a TCP connection is established.

• Client → Server: SYN
• Server → Client: SYN-ACK
• Client → Server: ACK

✅ TCP connection is now established.

Step 3: TLS Handshake (on top of TCP) A secure communication channel is created.

• ClientHello and ServerHello messages are exchanged
• The server sends its digital certificate
• The client verifies the certificate
• Key exchange occurs
• Session keys are generated

🔐 A secure TLS tunnel is established.

Step 4: Encrypted HTTP Request The client sends an encrypted request through the TLS connection.

GET / HTTP/1.1
Host: www.example.com

Step 5: Encrypted HTTP Response The server responds with encrypted content.

HTTP/1.1 200 OK
[HTML content]

Step 6: page Rendering The browser decrypts the response and displays the webpage.

Example 2: Video Call (VoIP Using UDP)

Real-time applications such as video calls prioritize speed and low latency, which is why they rely on UDP.

Step 1: Call Signaling The application first establishes call parameters.

• Often uses TCP or TLS for signaling
• Negotiates call parameters
• Exchanges encryption keys
• Agrees on codecs for audio and video

Step 2: Media Streaming (UDP) Once the call begins, audio and video data are transmitted.

• Video packets are sent via UDP
• Audio packets are sent via UDP
• There is no connection handshake

Why UDP is used:

✓ Low latency, essential for real-time communication ✓ Faster transmission than TCP ✗ Some packets may be lost (acceptable for video/audio) ✗ Packets may arrive out of order (handled by the application)

Small packet loss might cause a brief visual or audio glitch, but retransmitting packets would create noticeable delays.