Unit
- SSL (Secure Sockets Layer) and TLS (Transport Layer Security): Cryptographic protocols that provide secure communication over networks. SSL is the predecessor, and TLS is its modern successor. Both encrypt data in transit between clients and servers, preventing eavesdropping and tampering.
- Role of encryption: SSL/TLS uses symmetric encryption for bulk data transfer and asymmetric encryption for key exchange. This hybrid approach balances performance with security. Common symmetric ciphers include AES, while asymmetric algorithms include RSA and ECDSA.
- Authentication through certificates: Digital certificates bind a public key to an entity's identity. When a client connects to a server, the server presents its certificate, which the client validates against a trusted Certificate Authority (CA). This verifies the server's identity.
- Data integrity: SSL/TLS includes message authentication codes (MACs) to ensure that data is not modified during transmission. Any alteration is detected, and the connection is terminated.
- Protection against common attacks: SSL/TLS defends against man-in-the-middle (MITM) attacks, replay attacks, and session hijacking. Without it, data sent over HTTP can be intercepted easily on public networks.
- Evolution of protocols: SSL 2.0 and 3.0 are deprecated due to vulnerabilities. TLS 1.0, 1.1, and 1.2 saw widespread use, but TLS 1.2 remains common. TLS 1.3, released in 2018, offers improved speed and security by reducing handshake round trips and removing weak ciphers.
- Ubiquity in modern web: HTTPS, which uses HTTP over TLS, is now the standard for websites. Browsers mark HTTP sites as not secure. Email protocols (SMTPS, IMAPS) and VPNs also rely on TLS.
- Real-world impact: A modern e-commerce site processes millions of transactions daily, all protected by TLS. Without certificates, credit card numbers and personal data would be exposed. Proper SSL/TLS management ensures customer trust and regulatory compliance.
Code Example
Bash
# Check TLS version supported by a server using openssl
openssl s_client -connect example.com:443 -tls1_2
# Use -tls1_3 for TLS 1.3
# Look for 'New, TLSv1.2' in outputThis command checks if a server supports TLS 1.2. Replace the server name and port as needed. The output shows the negotiated protocol version and cipher suite.
Quick Revision
- SSL/TLS encrypts data in transit using symmetric and asymmetric cryptography.
- Certificates authenticate server identity through a chain of trust to a CA.
- Data integrity is ensured via MACs; tampering is detected.
- TLS 1.3 is the current recommended version for optimal security and performance.