Transport Layer Security (TLS)

TLS, or Transport Layer Security protocol, is one of the most prevalent protocols that are out there. You probably use it way more often than you think you do. Every time you check email, every time you browse the web, every time you stream a service, you're probably using TLS.

Why we need TLS

When you're browsing the web, you are connecting to different servers. So this user is connecting to the server, but how do they know they're connecting to the right server? How do they know that there is not somebody in between that they're actually connecting to, and they think they're connecting to their bank account, but instead they're connecting to somebody else's site?

When we're connecting to devices that we've never connected before, there's some things that we want some assurance on. We want to make sure that we're connecting to the right device. We want to make sure that there's no one eavesdropping in the middle and intercepting those messages and seeing what communication is going back and forth, seeing what our passwords are, seeing what our bank accounts are, making sure that they're not changing any data as it goes back and forth. And that's where TLS comes into play. TLS offers a certain level of authenticity, of confidentiality and integrity, even if we've never connected to that device before.

The history and versions of TLS

Just like any protocols, we develop things over time, so we can see a lot of different versions here. The first version came out in 1995 — at least the first published version — and we have the most recent version in 2018.

The first thing to note here is that in 1999 it went through a name change. It went from Secure Socket Layer to Transport Layer Security, from SSL to TLS. For that reason, you'll see that this will be named differently depending on what resource you look at. You'll see some just call it Transport Layer Security or TLS, where other sources will call it Secure Socket Layer or SSL, while others will call it SSL/TLS. It really means all the same thing. We really are talking about Transport Layer Security, or TLS.

Another reason why this is important is you may see in some of the packets these version number changes. We had these major steps here — 100, 200, 300 — but when it went from SSL 3 to TLS 1, we just get a minor step, because there wasn't a lot that actually changed with the protocol. So it went to 301, 302, 303, 304. So if you're trying to measure up against this, TLS 1.3 to this 304, it might be difficult to see that transition unless you see this big picture.

Another reason why this is important is because we make upgrades to this because of security concerns, so we don't want to use outdated versions here. However, not everybody can upgrade all at once, and because of that we need to go through transition periods. So what we do is we support more than one. We try to connect at the highest level possible, so we make an attempt to connect at a TLS 1.3, but if not, then we revert back to this TLS 1.2. And the stat, according to many different sources, is that in September of 2023, 99.9% of our websites, our secure websites, were using TLS 1.2, and 64.8% could utilize 1.3. So we still have not completely made that transition yet, but we're getting close.

I'm going to be talking both about TLS 1.2 and TLS 1.3, but most of the information that I'm going to be talking about is pulled from RFC 8446, which really is TLS 1.3 — that's the standard that specifies TLS 1.3. So just assume most of the stuff that I'm going to be talking about either applies to TLS in general or applies to TLS 1.3. However, there's going to be a few times I'll call out TLS 1.2, and at that point in time I'll let you know that this is TLS 1.2 and specific to TLS 1.2.

Where TLS is used

So where do we use TLS? There's lots of different applications on where we use TLS, but here are just a few examples: the web, file transfer, mail transfer, and client email connections. And we created these insecure protocols like HTTP, FTP, SMTP and IMAP, or Internet Message Access Protocol. So these are the insecure methods, or insecure protocols, that we used for communication that would just communicate in clear text.

What we've done is we've taken SSL and incorporated it into these protocols to create this secure version of these protocols, like HTTPS, FTPS and SMTPS. And when I say we incorporated it into these protocols, it really didn't change the original protocol all that much. What we see here is just the original protocol is then encapsulated with this TLS protocol, which then encrypts this information.

When we add TLS to these different protocols, we are adding an S to the end of the protocol. The name of that could mean something different, although it's all the same thing. What I mean by that is HTTPS could stand for HTTP Secure, or HTTP over SSL, or HTTP over TLS. It can mean all three of these; all would be correct in their naming, but it all just means that it's using TLS. Same thing for FTPS: that S could mean secure, or FTP SSL, but it means the same thing — it's using TLS.

TLS terminology

The terminology around TLS is pretty straightforward. We have a client and a server. The client is the one that's initiating the conversation, that's starting the conversation. The server is the one that's responding to that conversation and making the connection to the client. We call these endpoints. There's also, within this communication, for every packet that there is, there's going to be a sender — and that's just the endpoint transmitting the record — and a receiver, and the receiver is the one receiving those records.

The protocols within TLS

Now, TLS is a protocol, and a protocol is a set of communication rules between two devices so they know how to talk with each other, they know how to communicate with each other. Now, the TLS protocol actually has other protocols within it. That is, there are several protocols within the TLS protocol, and the two primary ones are the TLS record protocol and the TLS handshake protocol.

The TLS record protocol is in charge of fragmenting and reassembly. It's in charge of encrypting and decrypting, and verification and integrity. The TLS handshake protocol is in charge of the key exchange, negotiating cryptographic parameters, and the authentication piece.

So really, if we were to sum this up, the TLS record protocol is in charge of confidentiality and integrity, whereas the TLS handshake protocol is in charge of the authentication piece and establishing the parameters. And when I say establishing the parameters, they establish the parameters for the confidentiality and integrity.