TLS vs SSL: What is the Difference?

Security is the relevant topic on the Internet - in no other daily activity or form of communication is our personal security as threatened as when surfing the Internet and communicating electronically. Efforts to increase security and ensure it as completely as possible have been around for a long time: this is done by using powerful encryption for data transfer to and from the Internet. But what do the abbreviations SSL and TLS mean? What do the individual version numbers mean? And which of these encryption techniques is now more secure? Our article answers all the important questions on the topic in detail.

SSL and TLS - what does it mean?

Both abbreviations, SSL and TLS, stand for an encryption protocol - each with a different standard. They encrypt the data streams in traffic between the client and server - in simple terms, between the application computer and the Internet. SSL stands for "Secure Socket Layer" and TLS for "Transport Layer Security".

How encryptions and SSL connections work fundamentally in the context of websites is covered in detail in the article SSL Connection & Encryption.

Areas of Application for Encryptions

For most non-tech-savvy users, encryptions are only noticeable in the HTTP area, as the transition from http to https is visible, making it easy for users to recognize encryption.

Encryption can be used in numerous other cases, such as:

• POP3 to POP3S (email communication)
• SMTP to SMPTS (email communication)
• IMAP to IMAPS (email communication)
• IRC to IRCS (text-based chats)
• FTP to FTPS (file transfer over the internet)

Encryption is also used, for example, in connections via OpenVPN (software for creating a Virtual Private Network = VPN).

Further information can also be found in the articles on Shared SSL and StartTLS.

SSL as an Encryption Protocol

With SSL, you don't really need to know much: it was the earlier of the two encryption protocols, developed in 1995, and today is considered completely outdated and no longer used.

Version 1.0 had serious security vulnerabilities and was quickly replaced by version 2.0. As security vulnerabilities persisted, version 3.0 was released shortly thereafter. When security vulnerabilities also appeared in version 3.0, the entire SSL standard was discarded. In 1999, TLS was introduced as the successor protocol.

SSL certificates are usually issued for a domain. Under certain conditions, however, SSL certificates can also be issued for an IP address.

TLS as an Encryption Protocol

Initially, TLS version 1.0 differed little from the earlier SSL protocol, but it quickly evolved from the original version to version 1.1. However, these versions are now considered outdated and should not be used anymore. While web servers and web browsers still occasionally support the older versions, they issue a security warning when doing so.

The current standard is TLS 1.3, although under certain circumstances the predecessor protocol 1.2 can still be used. Just over 98% of all browsers still support version 1.2, so there are few issues here.

Components of the TLS Protocol

The two main components of the protocol are:

• Handshake, and
• Record

During the "Handshake," a key exchange takes place, as well as authentication. The data transfer is then encrypted and protected against alterations in the "Record" using the key negotiated by both sides.

In this context, it is important to differentiate between the terms "authentication" and "authentication": what the user does to the server is called "authentication," while what the server does to the user is "authentication." Therefore, one must always be careful not to use the term "authentication" incorrectly (from a technical standpoint).

One of the new features in version 1.3 is that long-term keys are no longer used as before; instead, a new key is negotiated separately for each connection. Exclusively, the DHE or ECDHE protocol is used for key exchange. Both measures lead to a significant improvement in security.

Possible Security Issues

A special focus on the security of TLS encryption must be directed towards the respective certificate. A certificate forms the basis for authentication and is issued by a certification authority.

Having a certificate alone does not guarantee one hundred percent security. Not all certification authorities are 100% trustworthy - and therefore, neither is a certificate issued by them. Such a "rogue" certificate then enables so-called Man-in-the-Middle attacks on data transfer and communication. The OCSP network protocol provides a way to validate the status of a certificate.

In the event of such a (successful) attack, the pre-authenticated Man-in-the-Middle offers both parties a key that he possesses, allowing him to easily intercept and potentially manipulate the transmitted communication in plaintext.

Users generally have the option to deactivate suspicious or insecure certification authorities in their own browser during communication and data transfer. However, the problem of possible Man-in-the-Middle attacks fundamentally persists, especially since it cannot be assumed that every user will not use a questionable certificate.

In TOR network connections, the possibility of a Man-in-the-Middle attack fundamentally exists only at the so-called Exit Node, which establishes the connection to the internet during communication. However, there is also a very high risk of such attacks here. Moreover, for security during data transfer between the individual routing points of a TOR network, one must also trust the routing to exclude attacks on communication or eavesdropping during data transfer by third parties.

Conclusion: TLS vs SSL

To ensure the maximum possible security, only modern encryption protocols should be used - currently TLS 1.3 and (in exceptional cases) version 1.2. The use of outdated protocol versions such as TLS 1.1, 1.0, or even SSL encryption is strictly prohibited for security reasons under all circumstances.

Find out more about the practical use of SSL certificates:
Do you need a separate SSL certificate for each domain?
Issuing an SSL certificate for IP addresses - is it possible?

Image credit: Gerd Altmann on Pixabay