March 23, 2020 0

SSL vs TLS: Decoding the Difference Between SSL and TLS

in Encryption

(21 votes, average: 4.19 out of 5)

Loading...

Do you know how the SSL and TLS protocols differ? Let’s find out how much you know…

Turtle vs tortoise. Pill vs tablet. Graveyard vs cemetery. SSL vs TLS. Can you tell what all of these pairs have in common?

Think about it for a moment. If you think each of these terms mean the same things, then you’re wrong! They’re actually not synonymous. Yes, you read that correctly — there are stark differences between the terms in each pair, and most of us may not realize it. While we won’t get into the differences between the first few pairs in this article (regardless of your current level of curiosity), we will explore the difference between secure sockets layer and transport layer security (SSL and TLS, SSL vs TLS, TLS vs SSL, or however you wish to refer to it).

SSL vs TLS: The Key Differences Between These Protocols

When people talk about SSL/TLS certificates, they’re talking about X.509 digital files that enable websites to be served via HTTPS (using the secure TLS protocol on top of the insecure HTTP connection) through the use of public key encryption. So, are SSL and TLS the same? Not entirely. But if they’re different, then why are the terms used interchangeably? Well, the answer is twofold:

1. Because they’re both secure protocols that establish encrypted communications between the web server and client (browser) via HTTPS.
2. People are slow to change, and in IT, there are a lot of terms to know. People are familiar with SSL, so it makes it easier to just go on, referring to TLS as SSL.

But the reason why they are different is because TLS is the successor of the SSL protocol. So, what does this mean? When comparing SSL vs TLS, the SSL and TLS protocols are different in their functions, authentication of messages, alert messages, record protocol, and encryption strengths. They also differ especially in terms of the process that’s known as “SSL/TLS handshake.” This process is performed when both the parties (client and server) interact with each other.

This handshake process is essentially responsible for:

• Determining the type of encryption that will be used to secure the data throughout the transaction,
• Authenticating the server (or both parties), and
• Generating/exchanging session keys that will be used throughout the transaction.

SSL vs TLS: How SSL and TLS Establish Connections

It’s important to note the difference between how SSL and TLS each establish connections. For example, the SSL handshake makes explicit connections via a port. TLS, on the other hand, facilitates implicit connections via protocol.

This handshake operates on specific methods/algorithms called “cipher suites.” Although there are many differences between SSL and TLS, the fundamental difference between SSL and TLS lies in these cipher suites that play a significant role in the security of the connection.

A cipher suite involves a key exchange algorithm, authentication/validation algorithm, bulk encryption algorithm, and a message authentication code (MAC) algorithm. Every SSL/TLS version has its own supported set of cipher suites, and newer versions keep coming up with more secure cipher suites that improve the security and performance of the connection

So, as you can see, SSL and TLS differ in many ways. Here’s the summary of all the differences and how to differentiate SSL vs TLS:

SSL	TLS
SSL stands for “Secure Socket Layer.”	TLS stands for “Transport Layer Security.”
Netscape developed the first version of SSL in 1995.	The first version of TLS was developed by the Internet Engineering Taskforce (IETF) in 1999.
SSL is a cryptographic protocol that uses explicit connections to establish secure communication between web server and client.	TLS is also a cryptographic protocol that provides secure communication between web server and client via implicit connections. It’s the successor of SSL protocol.
Three versions of SSL have been released: SSL 1.0, 2.0, and 3.0.	Four versions of TLS have been released: TLS 1.0, 1.1, 1.2, and 1.3.
All versions of SSL have been found vulnerable, and they all have been deprecated.	TLS 1.0 and 1.1 have been “broken” and are deprecated as of March 2020. TLS 1.2 is the most widely deployed protocol version.

A History of SSL and TLS: From the 90s to the Present

How did we get to where we are now in terms of TLS superseding SSL? We’ll explore how using SSL eventually morphed into using TLS.

The Early 90s: The Launch of SSL

From the moment Berners-Lee introduced the “World-Wide Web” (WWW) to the world in the 1990s, we witnessed something that could be possible only in movies and sci-fi books. We witnessed the internet, a whole new kind of world that had “intrigue” written all over it. The introduction of the World Wide Web democratized the internet, and by 1995, it’s estimated that the internet had around 16 million users.

This rapid adoption of the internet led to many new possibilities, as well as some problems. One of the major issues was the security and privacy of the users. As the businesses started going online, there was a massive apprehension regarding the safety of sensitive data such as credit card information, financial information, passwords, etc.

That’s what gave birth to the secure sockets layer, or SSL for short.

1995: It’s SSL Time…

SSL was an idea conceived by Taher Elgamal, an internationally renowned cryptographer who’s known as the “father of SSL.” A company known as Netscape developed SSL when Taher was their chief scientist. SSL was created to serve as an internet protocol that would facilitate secure communication. In simpler words, SSL was basically a set of instructions that guides the client (typically a web browser) and server transfer data securely.

SSL 1.0, the first-ever SSL version, was never released publicly as it contained severe security flaws. That led to the release of SSL 2.0 in 1995, which also included several security vulnerabilities — both from cryptographic and practical perspectives. These flaws were not severe enough to call for a crisis, but they were enough to prompt a search for its successor.

As a result, the third version (SSL 3.0) had to be released in 1996. This latest protocol was a total revamp compared to its predecessors and was a significant upgrade over the previous two versions. The final draft of SSL 3.0 was published by the Internet Engineering Task Force (IETF) in 1996.

1999: When SSL Becomes TLS – The Launch of TLS 1.0

Three years later, Christopher Allen and Tim Dierks of Consensus Development wrote the TLS 1.0 protocol, the upgraded version of SSL 3.0. Although the name change suggests a significant difference between both, there weren’t many differences between them.

The change in name, according to Dierks, was a face-saving gesture by Microsoft. He wrote:

“As a part of the horsetrading, we had to make some changes to SSL 3.0 (so it wouldn’t look the IETF was just rubberstamping Netscape’s protocol), and we had to rename the protocol (for the same reason). And thus was born TLS 1.0 (which was really SSL 3.1). And of course, now, in retrospect, the whole thing looks silly.”

2000s-Present: TLS Versions 1.1, 1.2 & 1.3 Are Put into Play

Since the release of the first TLS version, three more versions of TLS have been released. The first of which was TLS 1.1, released in 2006. This version included some significant upgrades compared to TLS 1.0. This includes added protection against cipher-block chaining (CBC) attacks and support for Internet Assigned Numbers Authority (IANA) registration parameters. Later on, both these versions (TLS 1.0 & 1.1) were found to be vulnerable, and both are set to be deprecated in March 2020.

Soon after the release of TLS 1.1 in 2006, TLS 1.2 was released in 2008. This version came with major security upgrades in terms of specification of hash and algorithm used by the client and server. Its nearly instant release of prompted the users to upgrade directly to TLS 1.2, instead of TLS 1.1. Right now, TLS 1.2 is the most widely adopted SSL/TLS protocol.

Thanks to the security advancements offered by TLS 1.2, it established itself as a secure protocol, and after a decade from its release, its successor, TLS 1.3, was released. TLS 1.3 was released in 2018 and offered essential security features such as removal of MD5 and SHA-224 support, use of Perfect Forward Secrecy, etc. Currently, we’re undergoing a transition from TLS 1.2 to TLS 1.3. All major players — CAs and browser alike — are pushing for its adoption.

SSL vs TLS: Do you Need to Replace Your SSL Certificates with TLS Certificates?

Well, of course not. That’s because both “SSL certificate” and “TLS certificate” essentially mean the same thing: They’re both X.509 digital certificates that help to authenticate the server and facilitate the handshake process to create a secure connection.

Some people call them “SSL certificates,” while others refer to them as “TLS certificates.” The name doesn’t matter much because a certificate isn’t the same thing as the protocol. Whatever you call them, what matters is the protocol that it operates on. And these protocols are determined by your server configuration, not by the digital certificates. So, you must make sure that your web server supports the latest TLS protocols.

Similarly, you must also enable server support for higher encryption strength. Why? Because encryption strength isn’t based on the certificate — it’s dependent on the configuration of the server and client.

Having said all this, these certificates are mostly called “SSL certificates.” Many people have started using the term “TLS certificate,” but you don’t need to get confused between them as both mean the same thing.

Final Thoughts: SSL and TLS Are Related Yet Not the Same

As you’ve learned in this article on SSL vs TLS, TLS is just the name spin-off of the less secure SSL protocol. They essentially perform the same functions in terms of serving a website via HTTPS, but how they get there different. Had TLS not been developed, we’d be talking about something like “SSL 5.0 vs SSL 4.0″ instead of “SSL vs TLS.”

• #SSL vs TLS