Ts (Transport Layer Security) is a encryption protocol that ensures the safety of data transmissions on the Internet. It succeeds the obsolete SSL protocol, and is today almost exclusively used in its TLS 1.3 version.
Secure email address for your digital life
- Professional data and security protection
- Email encryption with SSL/TLS
- Antivirus protection with firewall and anti-SPAM filters
- Daily backups, daily protection
What is TLS?
At the start of the web, the data security aspects were not as important as today. All communications were simply transmitted openly and without encryption from one computer to another. We can then compare this to a postcard: any factor can read it.
The TLS protocol (often designated SSL/TLS), introduced the encryption of content sent. To stick to the comparison mentioned above, this encryption corresponds to a sealed envelope that only the legitimate recipient can open.
The TLS abbreviation means « transport Layer Security », that is to say « safety of the transport layer ». This term refers to the transport layer of the TCP/IP model. The TLS protocol allows encrypt data flows on the Internet so that this data can only be read by authorized recipients.
Note
This protocol was once known as SSL (Secure Socket Layer). As this abbreviation is still widely used, we often speak of « SSL/TLS » to designate TLS.
TLS CLOSE all the traffic sent to TCP using a symmetrical encryption method.
What seems simple in theory is more complicated in reality. The basic problem is that the server must indicate the key to the customer, and that Before that communication is not secured with TLS. Anyone who sends encrypted attachments knows this problem well: you turn a file and then have to communicate the recipient the secret password, for example by phone.
The TLS protocol, whose current version (1.3) has been in force since 2018, uses the following procedure to solve this problem:
- Clienthello : The customer (for example a browser) sends a first message to the server containing information on the encryption methods he supports. This includes cryptographic consequences (Cipher Suites), the versions of the protocol, a random value, as well as a value specific to theExchange of different-Hellman keys based on elliptical curves (ECDHE value). A first block of encrypted data can possibly already be transmitted at this stage.
- Serverhello : The server selects the appropriate parameters and sends its response, including its own ECDHE value and its digital certificate. This SSL certificate proves that the server is authentic and does not seek to usurp an identity. In parallel, the server begins the calculation of the session key.
- Calculation of the key : the two parties then independently calculate the same session key (Key session) from that previously exchanged.
- End of Handshake and start of secure communication : the server ends the exchange (Handshake) and starts the encrypted communication. The customer does the same; The connection is now fully secure.
Note
Compared to the previous versions, the Handshake TLS of version 1.3 is much lighter and more secure. The entire process described here requires only one round trip (1 RTT), which significantly accelerates the establishment of the connection.
The reason why asymmetrical encryption with Diffie-Hellman is only used for the transmission of the session key (but not for the encryption of the data flows themselves) is a question of speed; asymmetrical encryption is relatively slow And would therefore significantly delay data communication.
The advantages and disadvantages of the TLS protocol
TLS is an effective solution for making web traffic safer. Indeed, this solution does not require both parties that they themselves quantify the content (the data of a form for example). Instead, it is enough that the transfer is made via the TLS protocol, whatever the operating systems and software applications of both parties. All data flows are then automatically quantified during transmission.
The price of security is a slightly slower connection configuration, because the steps of the process described above (certificate, random number and key exchange) are resourceful.
TLS uses
As mentioned above, the TLS is universally applicable, because it is independent of applications and operating systems. Consequently, there is a secure TLS version for various application protocols. The denomination scheme is quite simple in most cases: the letter » S Is placed after the name of the protocol if it communicates via TLS.
The most important field of application of the TLS is Internetand more specifically the HTTP protocol. Its encrypted variant is called https.
The following applications, frequently encountered, must also be mentioned:
- Pop3s : Recover the server emails using the POP3 protocol
- Imaps : synchronize your reception box with the server using the IMAP protocol
- SMTPS : send emails
- Ftps : transfer of files via the FTP protocol
- Sips : Voip telephony (Voice-over-IP) using the SIP protocol
- IRCS : Discussions (cats) encrypted
- Quic : Google transport protocol integrating TLS 1.3; Alternative to TCP for faster and more secure web connections (for example with HTTP/3)
Openvpn is free software to build a Virtual Private Network (VPN) which also uses the TLS protocol.
TLS implementations
The main implementations of transport Layer Security are as follows:
- OpenSSL : by far the most common application used for most HTTPS sites
- Grit (Free Software Foundation)
- Free (OpenBSD)
- Nss (Network Security Services)
- Boringssl (Google)
- Rustls (Joe Birr-Pixton, Dirkjan Ochtman, Daniel McCarney, Josh AAS and the open source community)
- Botan (BSD license, Jack Lloyd)
- Sse (Java Secure Socket Extension, Oracle)
- S2n (Amazon)
This list is not exhaustive. Detailed information on the various implementations of the TLS is available on Wikipedia in English.
Known vulnerabilities of TLS
Even TLS is not immune to attacks and is not free from certain dangers. The known attack points are as follows:
- Programming errors :: Heartbleed Buga major bug in the old versions of OpenSSL, has become famous. It was corrected in 2014.
- Weakened encryption : Due to the export restrictions of American encryption, less secure « exportable » versions have been put into circulation.
- Vulnerability linked to compression : The use of HTTP compression instead of TLS compression allows hackers to deduce encrypted content.
- Example of exploitation : attack Beastdescribed in 2014, targeted TLS 1.0. Recent versions are no longer vulnerable.
- Old well -known flaw :: Padding oraclediscovered in 2002, affected the versions to SSL 3.0. TLS 1.3 is spared.
- Bypass :: Alpacaidentified in 2021, has shown that TLS certificates could be exploited on poorly configured servers to intercept or divert communications.
Efforts have also been made to prevent fully secure TLS encryption so that the authorities can have an overview of encrypted communications, for example in relation to financial transactions and criminal activities. The ETSI (European Institute of Telecommunications Standards) has at a given time studied the possibility of establishing a « controlled access point » to TLS encryption, in order to allow the authorities access to certain communications, in particular within the framework of the fight against crime.
