Scenario: Secure Web Connection Handshake: $(3$ Marks $)$

You are a system administrator responsible for configuring and securing a web server. A user is

attempting to access your website using HTTPS$,$ and you want to ensure a secure handshake

session. Describe the steps involved in the handshake session between the user's web browser

and your web server.

Questions:

Initiation:

What triggers the initiation of a handshake session when a user tries to access a website

over HTTPS$?$

ClientHello:

a$.$ Describe the purpose and content of the "ClientHello" message sent by the user's web

browser during the handshake.

b$.$ From Wireshark, inspect the "ClientHello" message and show the cipher suites supported

by your browser.

c$.$ Identify the compression method used in the "ClientHello."

d$.$ What is the session ID$,$ and where is it found in the "ClientHello" message?

e$.$ Analyze the random number generated in the "ClientHello."

Server Hello:

a$.$ What is the role of the "ServerHello" message, and what information does the web server

provide in response to the "ClientHello"?

b$.$ From Wireshark, inspect the "ServerHello" message and identify the chosen cipher suite.

c$.$ Is the session ID the same from "ServerHello"? What does this refer to$?$

d$.$ Is the random number the same from "ServerHello"? Why?

Key Exchange:

a$.$ Explain the key exchange process during the handshake session. How is the symmetric key

negotiated between the client and server for secure communication?

Certificate Exchange:

$$ Why is the exchange of digital certificates an essential part of the handshake session? What

information do these certificates contain?

$$ From Wireshark, check for the digital certificate exchange between KKU and your browser.

Explain its role in the handshake.

Finished Message:

$$ After the key exchange and certificate verification, what is the purpose of the "Finished"

message exchanged between the client and server?

Ensuring Security:

$$ How does the handshake session contribute to the overall security of the communication

between the user's web browser and the web server? What vulnerabilities does it help

mitigate?