WHAT IS SSL, TLS AND HTTPS

SSL/TLS are cryptographic protocols that provide communications security over a computer network.

WHAT IS SSL ?

SSL (Secure Sockets Layer) is a standard security technology to create an encrypted link between a server and a client. This link ensures that all data passed between the server and the client remain private and secure.

It was designed to support protocols such as FTP, HTTP, TELNET.

HISTORY OF SSL :

The Secure Sockets Layer or SSL was developed by Netscape in 1994 to provide security for web traffic.

The first version “SSL version 1.0”, due to its weak cryptographic algorithms and some security flaws, it was never released for public use.

The second version 2.0 was released in 1995 considered fairly strong, used MD5. But, it was vulnerable.

The next version 3.0 was released in 1996. Which was a complete redesign of the protocol.

SSL :

SSL ensures that all the data transmitted will be encrypted.
Two files, Certificate and Private Key are used.

A Digital Certificate certifies the ownership of a public key by the named subject of the certificate.

A Certification Authority (CA) is a trusted entity that issues electronic documents (Certificates) that verify a digital entity's identity on the Internet .

Standard SSL Handshake:

The handshake protocol defines how the SSL connection is established between the client and the server.

1. Client Hello : Client connects to the server. It contains information like SSL version, cipher settings.

2. Server Hello : Server sends a copy of its SSL Certificate with server's public key. IT contains information like SSL version, cipher settings and public key.

3. Authentication and Pre-master Secret : Server certificate is authenticated by the client. If its valid, client encrypts the pre-master secret (a symmetric session key) using server's public key and sends it to the server.

4. Decryption and Master Secret : Server uses its private key to decrypt the symmetric session key and sends acknowledgement encrypted with master secret (session key).

5. Encryption with Session Key : All data will now be encrypted and transmitted with the session key.

TLS :

TLS (Transport Layer Security) is a updated, more secure version of Secure Sockets Layer protocol, or SSL.

TLS 1.0 was developed in 1999. There is no much difference between TLS 1.0 and SSL 3.0, but they are different standards. TLS 1.0 was more secure than SSL 3.0. TLS 1.0 and SSL 3.0 do not interoperate. Vulneabilities such as POODLE , DROWN have shown that SSL is insecure.

TLS 1.1 and 1.2 are the later editions in the TLS family which uses better ciphers.

TLS v1.3 is still a working draft and not well supported yet.

HTTPS :

Hypertext Transfer Protocol Secure (HTTPS) or “HTTP Secure,” is an application specific implementation that is a combination of the Hypertext Transfer Protocol (HTTP) with the SSL/TLS. HTTPS is used to provide encrypted communication and secure identification of a server, so that no middle man can intercept the data easily.

• It is always better to use HTTPS over HTTP.
• Make sure you are using HTTPS while providing sensitive information.

WHAT SHOULD YOU USE?? SSL OR TLS?

If you are configuring a server, install softwares that supports the latest version of the TLS standard with proper configurations. This ensures that the connections made are as secure as possible and can avoid MITM.

If you are configuring a program (like E-mail) and have an option to connect securely via SSL or TLS, feel free to choose either one as long as it is supported by your server.

But it is better to use TLS as it is more secure and has fix to those vulnerabilities in SSL.