Transport Layer Security (TLS) is an Internet Engineering Task Force (IETF) standard protocol that provides authentication, privacy and data integrity between two communicating computer applications. It’s the most widely deployed security protocol in use, preventing man in the middle attacks and is best suited for web browsers and other applications that require data to be securely exchanged over a network. This includes web browsing sessions, file transfers, virtual private network (VPN) connections, remote desktop sessions and voice over IP (VoIP). More recently, TLS is being integrated into modern cellular transport technologies, including 5G, to protect core network functions throughout the radio access network (RAN).
Since introduction of SSL in 1995, it has undergone multiple revisions to improve security and to mitigate attacks. Following SSL 3.0’s release, SSL 3.1 was introduced and due to a lack of interoperability with SSL 3.0, SSL 3.1 got rebranded to Transport Layer Security (TLS). Although the terms SSL and TLS are often used interchangeably it should be important to note that all SSL versions (2.0 and 3.0) are deprecated due to numerous security vulnerabilities but SSL (secure sockets layer) introduced the following 3 principles that are the staple of communication on today’s modern internet.
· The connection is Private because the data is encrypted between the client and the server.
· The communicating parties are Authenticated to ensure each party is talking with their intended host.
· The connection is Reliable in that no modification of the communication can occur without detection.
TLS 1.0 was incredibly similar to SSL 3.0 – but still different enough to require a downgrade before SSL 3.0 could be used. As the creators of the TLS protocol wrote:
“The differences between this protocol and SSL 3.0 are not dramatic, but they are significant enough that TLS 1.0 and SSL 3.0 do not interoperate.”
TLS 1.1 came out seven years later in 2006, replaced by TLS 1.2 in 2008. Currently TLS 1.3 is being used, which was finalized in 2018 after 11 years and nearly 30 IETF drafts.
The benefits of Transport Layer Security
TLS-encrypted session provides a secure authentication mechanism, data encryption and data integrity checks, however, when comparing TLS to another secure authentication and encryption protocol suite, such as Internet Protocol Security, TLS offers added benefits. These include benefits such as the following:
· Security is built directly into each application, as opposed to external software or hardware to build IPsec tunnels.
· TLS offers logging and auditing functions that are built directly into the protocol.
· Transport Layer Security uses HMAC (Hashing for Message Authentication Code) & Enhanced Pseudorandom Function (PRF), which are way higher than the traditional authentication method “Keyed Message Authentication” used by SSL protocol.
· The type of certificate that should be used between the systems can be specified by the Transport Layer Security protocol.
· Detailed information about the alerts observed in a session will be provided by Transport Layer Security.
· There is true end-to-end encryption (E2EE) between communicating devices.
· There is granular control over what can be transmitted or received on an encrypted session.
· Since TLS operates within the upper layers of the Open Systems Interconnection (OSI) model, it doesn’t have the network address translation (NAT) complications that are inherent with IPsec.
SSL/TLS ensures secure communication between a client and server by using certificates that authenticate the server’s identity and an asymmetric key pair to exchange a secure key. The key exchange algorithm used must support forward security to prevent past sessions from being compromised if a private key is compromised in the future. Once the session key is exchanged, a symmetric encryption algorithm is used to encrypt all subsequent communication, and the message authentication code algorithm is used to detect any tampering with the data. This ensures that all communication is secure and cannot be intercepted or altered by unauthorized parties.
· A client tries to open up a communication with a target server. The client also sends a list of its supported cipher suites.
· The server responds with the most secure cipher suite supported by both the client and the server. The server also sends its public certificate.
· The client then verifies the signature is from a trusted certificate authority (Check Deciphering SSL). Depending on the Authentication Algorithm the server will have hashed a message with its private key. If the client decrypts the message with the public key of the server, and the message is correct, then the client knows that the server is authorized.
· The client will then attempt to negotiate a symmetric key using the Key Exchange Algorithm (This will result in back-and-forth communication between the client and the server. The exact number of messages depends on the algorithm).
· Once the key has been negotiated, both parties are now able to start communicating securely
· The client sends its first HTTP request and encrypts it with the Bulk Encryption Algorithm. The server is able to decrypt the request with the negotiated key (same key as the client). The server will also verify the integrity of the data by using the Message Authentication Code Algorithm.
· The server then sends its encrypted HTTP Response to the client. The client then decrypts the message and verifies its integrity.
· This back and forth will continue for as long as the session is active. Once the session is over, new session keys will need to be exchanged to start a new round of secure communication.
Difference between SSL and TLS
Both SSL and TLS are cryptographic protocols between networked servers, computers, and devices for authentication and data encryption. Although the concept is the same through each version, but if you were comparing SSL 2.0 to TLS 1.3 there would be a canyon between them.. It’s just the way the different protocols go about accomplishing the task of encrypting connections that diverges.
Each newly released version of the protocol came and will come with some improvements. SSL version 1 was never released, version 2 did but had few major flaws, SSL version 3 was a rewrite of version 2 but with limited success and TLS version 1 was an improvement of SSL version 3. Between TLS 1.0 and 1.1, the changes were minor but TLS 1.2 brought some significant changes and TLS 1.3 has refined and streamlined the whole process.
SSL and TLS simply refer to the handshake that takes place between a client and a server. The handshake doesn’t actually do any encryption itself, it just agrees on a shared secret and type of encryption that is going to be used. An SSL handshake uses a port to make its connections. This is called an explicit connection. Port 443 is the standard port for HTTPS, but there are 65,535 ports in all – with only a few dedicated to a specific function.
On the other hand , TLS, begins its connections via protocol. This is called an implicit connection. The very first step of the handshake – the act that commences it – is called a client hello. With TLS this is sent via an insecure channel and the connection switches to port 443 (or the port assigned) once the handshake has begun.
With SSL a myth originated that SSL/HTTPS slows down your website as the handshake involved several roundtrips as authentication and key exchange take place, this added latency to connections. Each new iteration of the protocol has worked to reduce the latency added by the handshake. By TLS 1.2, it was proven that HTTPS was actually FASTER than HTTP owing to its compatibility with HTTP/2.
TLS 1.3 has refined the handshake even further. It can now be accomplished with a single roundtrip and enables Zero roundtrip resumption (0-RTT). Part of the way this was done was by reducing the number of cipher suites it supports, from four algorithms to two.
Now it’s simply a bulk encryption (symmetric/session) algorithm and a hashing algorithm. The key exchange and digital signature negotiations have been removed. Key exchange is now performed using a Diffie-Hellman family, which both enables perfect forward secrecy by default and allows the client and server to provide their portion of the shared secret on their first interaction. That first interaction is now encrypted, too, shutting the door on a possible attack vector.
Advantages and Disadvantages of TLS
Pros
· Data Integrity : TLS guarantees that no information that’s being transmitted gets misplaced on its way. It’ll reach its goal safely. Unlike in SSL where it uses Keyed Message Authentication, TLS uses a cryptographic method known as the HMAC (Key-Mashing Authentication Code). This method ensures that record cannot be tampered whiles it’s on transfer over the internet.
· Reliable and Trustable: Whenever a site is secured by the TLS, it can be considered to be reliable. This is especially true for retailers and commercial websites. When the customers notice the green lock mark, they can be confident enough to conduct transactions.
· Prevention of Malware / Virus : Hackers or Attackers can come up with malware that alters the communication between the internet browser and the client. Utilizing TLS, these sorts of assaults are avoided. Hence, information is not spilled over.
· Reactive Alert System : At whatever point there are issues amid sessions and reports, clients are cautioned promptly.
Cons
· Latency Issues : Compared to other encryption strategies, at whatever point TLS is utilized, extra idleness will be included in the site’s activity. Thus TLS gives higher inactivity.
· Possibility of Man-in-the-Middle Attacks : Although TLS is, for the most part, considered to be secure, a few forms of TLS is still defenceless to MitM attacks.
· Platform Compatibility: Even though latest versions of TLS support many of the platforms, there are some versions such as TLS 1.3 that is only able to support few of the platforms. Popular Operating system provider Microsoft is facing difficulty with the implementation process.
· Cost of Implementation: Actualizing a TLS certificate isn’t free, there are a few costs included. However due to the competition in the TLS industry, the cost of TLS certificate has been drastically reduced. The amount that needs to be paid depends upon the number of domains and sub domains. Apart from that it may also depend upon identity verification.
· Complexity in Network Architecture: Complexity within organized engineering is another major drawback of the TLS certificate. In this case, consequently, the arranged topology can too end up complex, driving more come-up short overs. In arranging for taking care of this, there ought to be a legitimate arrange master contracted.
To wrap up, TLS is a core protocol for the modern internet, enabling secure communications, web browsing, and more. Websites that don’t support TLS will find themselves unable to use HTTPS to securely communicate with visitors, running the risk of sensitive data exposure. Additionally, modern browsers flag any website that does not use HTTPS, or has expired/invalid TLS certificates as insecure, often preventing users from visiting them.