What is TLS?

Transport Layer Security (TLS according to abbreviationfinder) and its now obsolete predecessor, Secure Sockets Layer (SSL) are cryptographic protocols designed to ensure the security of communications over computer networks. Several versions of the protocol are widely used in services such as the web, e-mail, instant messaging, and IP telephony (VoIP). Websites can use TLS to secure communication between their servers and Internet browsers.

The TLS protocol aims to provide privacy and data integrity between two or more computer applications. When some communication is secured by TLS, for example between a client (internet browser) and a server (eg Wikipedia.rog), then it should have some of the following properties:

• The connection is private(or secure ) because symmetric cryptography is used to encrypt the transmitted data. Encryption keys are created uniquely for each connection and are based on a shared secret agreed upon at the beginning of the session (the so-called TLS handshake). The server and client establish a connection and determine which encryption algorithm and cryptographic keys to use before transmitting the first byte of data. The negotiation of that shared secret is secure on both sides, and impossible to find out by an attacker. No attacker can change the communication during the communication negotiation without being detected).
• The identity of communicating parties can be authenticatedusing public key cryptography. This authentication check can be made optional, but is usually required for at least one of the parties (usually the server).
• The connection is reliablebecause each transmitted message includes a message integrity check using a message authentication code to prevent undetected data loss or alteration during transmission.

TLS is a proposed Internet Engineering Task Force (IETF) standard, first defined in 1999, and the current version TLS 1.3 is defined by IETF RFC 8446

TLS and SSL do not fit into any of the OSI layers or the TCP/IP model. As TLS only secures some transport protocol (such as TCP) it can be considered to run over the transport layer. It also provides encryption for some higher layers which should normally be a function of the presentation layer. Most applications still use TLS as a transport layer, but the job of establishing and managing the connection is in the hands of the application.

Digital certificates

A digital certificate confirms the ownership of the public key by the named subject of the certificate. This allows others to rely on signatures or assertions made by the private key corresponding to the certified public key.

Certification authorities

TLS typically relies on a set of authorized third-party certificate authorities to determine the authenticity of certificates.

According to Netcraft, which monitors active TLS certificates, the leading certificate authority (CA) was Symantec, which currently accounts for just under a third of all certificates and 44% of valid certificates used by the top 1 million websites.

Algorithm

Key exchange

Before the client and server can begin exchanging information protected by TLS, they must securely exchange and agree on an encryption key and cipher to use when encrypting the data. Among the methods used for key exchange and agreement are: public and private keys generated with RSA (denoted as TLS_RSA in the TLS handshake protocol), Diffie–Hellman (TLS_DH), ephemeral Diffie–Hellman (TLS_DHE), elliptic curve Diffie–Hellman ( TLS_ECDH), Ephemeral Elliptic Curve Diffie – Hellman (TLS_ECDHE), Anonymous Diffie – Hellman (TLS_DH_anon), Pre-Shared Key (TLS_PSK) and Secure Remote Password (TLS_SRP).

Data integrity

Message authentication code (MAC, translated Message authentication code) is used for data integrity. HMAC is used for CBC mode block ciphers and stream ciphers. AEAD is used for authenticated encryption such as GCM mode and CCM mode.

Application and adoption

In application design, TLS is usually implemented on transport layer protocols, so all data is encrypted on protocols such as HTTP, FTP, SMTP, NNTP, and XMPP.

Historically, TLS was primarily used for reliable protocols, such as Transmission Control Protocol (TCP). However, it is also implemented on protocols such as UDP and DCCP.

Websites

The primary use of TLS is to secure World Wide Web traffic between a website and a user’s Internet browser that is encoded using the HTTP protocol. When TLS is used, that protocol is then HTTPS. The addition of the letter S is for the English word secure, which means safe.

Internet spreadsheets

The latest versions of all major web browsers support TLS versions 1.0, 1.1 and 1.2 and are enabled immediately upon installation. The only one that has problems with the new security standards is Internet Explorer, which should be completely replaced with Microsoft Edge.

Libraries

Most SSL and TLS software libraries are free and released as open source. The most used is OpenSSL.

• BoringSSL, a fork ofOpenSSL for Chrome/Chromium and Android as well as other Google apps.
• Botan, a BSD-licensed cryptographic library written in C++.
• cryptlib: portable open source cryptographic library (includes TLS/SSL implementation)
• Delphi developers can use the Indy library which uses OpenSSLor ICS which now supports TLS 1.3.
• GnuTLS: free implementation (LGPL license)
• Java Secure Socket Extension : The Javaimplementation included in the Java Runtime Environment supports TLS 1.1 and 1.2 starting with Java 7. (TLS 1.1/1.2 were disabled by default for the client on Java 7, but were enabled in January 2017) Java 11 supports TLS 1.3.
• LibreSSL: a fork of OpenSSL by the OpenBSD project.
• MatrixSSL: dual licensed implementation
• mbed TLS (formerly PolarSSL): A small SSL library implementation for embedded devices designed for ease of use
• Network Security Services: FIPS 140 validated open library
• OpenSSL: free implementation (BSD license with some extensions)
• SChannel : Microsoft Windowsimplementation of SSL and TLS as part of the package.
• Secure Transport: Implementation of SSL and TLS used in OS Xand iOS as part of their packages.
• wolfSSL (formerly CyaSSL): A built-in SSL / TLS library with a strong focus on speed and size.