The Internet is based on a bunch of protocols. Along with IP, HTTP, TCP, and other protocols, the TLS protocol is a key part of every Internet connection. So what is the TLS protocol? How do TLS connections and TLS encryption work? Between whom or what does the TLS handshake take place? How do you obtain TLS certificates? And what is the difference between SSL and TLS?
Transport Layer Security, or TLS as it is more commonly known, is a cryptographic security protocol for the Internet that provides encryption, authentication, and secure data exchange between two interacting web servers. It is used in HTTPS connections, which are protected by appropriate certificates.
One example of the use of a secure TLS connection is email. The security protocol encrypts the email and prevents unauthorized access by third parties during transmission from one user to another, i.e., from server to server.
The protocol was developed back in 1995 and has since been improved to meet modern security standards. TLS 1.2 is responsible for implementing three levels of security: encryption, authentication, and integrity. Encryption ensures the confidentiality of transmitted data, while authentication verifies the validity of the parties exchanging information. The protocol also monitors the integrity of the transmitted data.
Versions of TLS protocols
The first version of the TLS protocol was developed in the 1990s and was called SSL 2.0, but it was quickly updated to SSL 3.0. A few years later, numerous vulnerabilities were discovered in this version of the protocol, and a new standard called TLS 1.0 was introduced based on SSL 3.0, which was later replaced by TLS 1.1, which had enhanced capabilities and was less vulnerable to cyber threats.
Today, we use the TLS 1.2 protocol, the latest and most up-to-date version of TSL, which is regularly updated unlike its predecessors.
It is also worth noting that the TLS protocol was developed to work on the Transmission Control Protocol, better known as TCP. And for working on User Datagram Protocol, or UDP, there is a special version of the protocol – DTLS. Therefore, the difference between TCP and UDP also determines the difference between the TLS and DTLS protocols.
What is TSL encryption for?
TLS (transport layer security) literally translates as a transport layer security protocol. From the name, it is clear that the main task of TLS encryption is to ensure secure data transmission between servers or computers on the Internet. We say secure, not safe, data transfer because the TLS protocol is only part of a complex mechanism for ensuring the security of the information exchange process and does not provide security on its own.
How does the TLS protocol work?
As already mentioned, the TLS protocol performs three main functions: encryption, authentication, and integrity. To understand how these functions are implemented, you need to understand how this cryptographic Internet protocol works.
Any action on the network, whether it is a search query, moving from one page of a website to another, or any other interaction, is an interaction between the user and the server. Each such interaction is a transaction, and a set of transactions is a session. The TLS SSL protocol protects transactions and sessions in three stages: TLS Handshake, False Start, and Chain of Trust.
TLS Handshake
TLS Handshake is a kind of handshake during which the interacting nodes decide which version of the protocol and connection parameters will be used for further communication. How does a TLS connection work in practice?
In the first stage, the user sends a “hello” request to the server, signaling that they want to establish a connection. This request contains information about the encryption algorithms that are suitable for this network node.
Next, the server selects the appropriate encryption type from the list provided and sends a response to the user containing an SSL certificate and a public key.
The next step involves the client generating a secret key based on the server’s public key and sending it to the server with which it is interacting. From this point on, both nodes will only use private keys, and symmetric cryptography will make the connection faster and less resource-intensive.
In turn, the server decrypts the premaster key sent by the client and uses it to create a symmetric key.
Now that symmetric encryption is established, the client and server can securely exchange encrypted messages.
The handshake process described above consumes a large amount of computing resources, so another mechanism is also provided to avoid repeated verification and connection procedures for each subsequent transaction. This process is called TLS False Start.
Thus, if transactions are performed within a single session, the TLS protocol simply uses the data that was processed and approved at the beginning of the session. At the same time, each session has its own lifetime, after which a new session is started, beginning with the handshake procedure we already know.
The False Start procedure increases protocol performance and significantly reduces computational costs.
TLS Chain of Trust is another integral procedure of the TLS protocol, which is responsible for node authentication, i.e., verifying the authorship of the transmitted information. This chain of trust repeatedly verifies authenticity—the compliance of certificates with specified standards—and, if a certificate is compromised, revokes the data and interrupts the transaction and the session as a whole.
