I understand the basic steps in the TLS handshake. My question is, where and how does one-way hashing fit into the steps below? Is it the session key that is hashed? Many texts mention that the original "message" is sent to check integrity, but what is this "message" exactly? I've looked at IBM's documentation on the topic, but am still confused as to how hashing fits into the steps below. Any examples, shown within the steps below would be appreciated.
- Browser connects to server secured with TLS (https)
- Browser requests server to identity itself
- Server sends a copy of its TLS Certificate that includes the server’s public key
- Browser checks the certificate root against a list of trusted CAs
- If the browser trusts the certificate, it creates, encrypts and sends back a symmetric session key using the server’s public key
- Server decrypts the symmetric session key using its private key and sends back an acknowledgement encrypted with the session key to start the encrypted session
- Server and Browser now encrypts all transmitted data with the session key