The TCP/IP protocol stack and the TLS handshake

The four layers

The TCP/IP model is the practical stack used on the internet. It merges some OSI layers.

Encapsulation through the stack

Sending: the application layer creates the data (for example an HTTP request); the transport layer adds a TCP header (source and destination ports, sequence number, checksum) to make a segment; the internet layer adds an IP header (source and destination IP addresses, time to live) to make a packet; the link layer adds a frame header (MAC addresses) and trailer to make a frame.

Receiving: the link layer checks and strips the frame; the internet layer checks the IP address and strips the IP header; TCP puts segments back in order using sequence numbers, requests any missing ones, and passes the data to the application identified by the port number (for example 443 for HTTPS).

TLS (and SSL)

TLS (Transport Layer Security) replaced the older SSL. It sits between the application and TCP and gives encryption (confidentiality), authentication of the server (certificates) and integrity (messages cannot be altered unnoticed). HTTPS = HTTP over TLS.

The TLS handshake, simplified:

1. Client hello: the browser sends the TLS versions and cipher suites it supports and a random number.

2. Server hello: the server picks a version and cipher suite, sends its random number and its digital certificate (containing its public key), signed by a certificate authority.

3. Authentication: the client checks the certificate against trusted certificate authorities.

4. Key exchange: the client and server agree a shared session key, for example by the client encrypting a secret with the server's public key so only the server's private key can read it.

5. Finished: both sides confirm, then all data is sent with fast symmetric encryption using the session key.

Why the two kinds of encryption?

Asymmetric (public key) encryption solves the key-sharing problem but is slow. Symmetric encryption is fast but needs a shared key. TLS uses asymmetric encryption only to agree the session key, then symmetric encryption for the bulk data.

Worked example

Explain how TCP makes sure a file arrives complete and in order even though packets take different routes.

1. TCP numbers each segment with a sequence number.
2. The receiver acknowledges segments it receives.
3. Segments not acknowledged in time are resent.
4. The receiver uses the sequence numbers to reassemble segments in the right order before passing the data to the application.

Answer: Sequence numbers, acknowledgements and retransmission.

Check yourself

1. Which TCP/IP layer adds the source and destination IP addresses?
   • Transport layer
   • Internet layer
   • Application layer
   • Link layer
   Show answer

   Internet layer. IP works at the internet layer.

2. What does the transport layer use to deliver data to the correct application on a device?
   • MAC addresses
   • Domain names
   • Certificates
   • Port numbers
   Show answer

   Port numbers. For example port 443 for HTTPS, 25 for SMTP.

3. Why does TCP give each segment a sequence number?
   • So routers can choose the shortest path
   • So the receiver can reassemble segments in order and spot missing ones
   • So the data is encrypted
   • So the MAC address can be found
   Show answer

   So the receiver can reassemble segments in order and spot missing ones. Packets may arrive out of order or not at all.

4. In the TLS handshake, what does the server send so the client can authenticate it?
   • Its private key
   • The session key in plain text
   • A digital certificate containing its public key, signed by a certificate authority
   • Its MAC address
   Show answer

   A digital certificate containing its public key, signed by a certificate authority. The client checks the certificate's signature and details.

5. After the TLS handshake, how is the web page data encrypted?
   • With symmetric encryption using the agreed session key
   • With the server's private key for every message
   • It is not encrypted after the handshake
   • With the client's MAC address
   Show answer

   With symmetric encryption using the agreed session key. Symmetric encryption is much faster for bulk data.

6. What is the first message of a TLS handshake?
   • Server certificate
   • Finished
   • Client hello, listing supported versions and cipher suites
   • Session key
   Show answer

   Client hello, listing supported versions and cipher suites. The client starts by saying what it can do.

7. What is the relationship between SSL and TLS?
   • TLS is the newer, more secure successor to SSL
   • SSL is a newer version of TLS
   • They work at the physical layer
   • SSL encrypts and TLS only compresses
   Show answer

   TLS is the newer, more secure successor to SSL. SSL is obsolete; TLS replaced it, though the name SSL is still used loosely.

Practise with instant feedback Print this lesson

Sources

• Pearson Edexcel International Advanced Subsidiary and Advanced Level in Computer Science specification (2026), Issue 1
• Pearson Edexcel IAL Computer Science sample assessment materials (Unit 3 paper, resource booklet and mark scheme)

Last updated 8 November 2026. Spotted a mistake? Tell us.