All major web browser makers announced on October 15, 2018, that the browsers that they produce will stop supporting the standards TLS 1.0 and TLS 1.1 in 2020.

The change was announced by Google, Apple, Microsoft, and Mozilla on company websites.

Transport Layer Security (TLS) is a security protocol used on the Internet to protect Internet traffic. It uses encryption to protect the data from eavesdropping.

TLS 1.0 and TLS 1.1 are old standards. TLS 1.0 turned 19 this year, a very long time on the Internet. The main issue with TLS 1.0 is not that the protocol has known security issues but that it doesn’t support modern cryptographic algorithms.

History & Development of SSL/TLS:

Transport Layer Security (TLS), and its now-deprecated predecessor, Secure Sockets Layer (SSL), are cryptographic protocols designed to provide communications security over a computer network. Several versions of the protocols find widespread use in applications such as web browsing, email, instant messaging, and voice over IP(VoIP). Websites can use TLS to secure all communications between their servers and web browsers.

SSL and TLS are often referred to as a group – e.g. SSL/TLS

SSL which was initially invented by Netscape in 1994.

The SSL 1.0 version was never released to the public because of its serious security flaws. The SSL 2.0 was released in February 1995 and was later replaced by SSL 3.0 which is regarded as a complete redesign of the protocol performed by the American cryptographer Paul Kocher in collaboration with Netscape’s engineers in the year 1996.

Dr. Taher Elgamal, who was the chief scientist at Netscape Communications from 1995 to 1998, is considered the “Father or SSL”

In 2014, researchers at Google disclosed the ‘POODLE’ vulnerability, which could allow attackers to decrypt encrypted connections to websites that use the SSL 3.0 protocol using a Man-in-the-Middle (MitM)attack – a popular way to intercept data.

This is where the hacker inserts a process in between the client and server through which their communication passes through, allowing the hacker to listen in on a private communication. The hacker may also be able to redirect the client to a web site controlled by the hacker where the hacker will infect the client with malware and/or commit financial fraud.

SSL 2.0 was prohibited in 2011. SSL 3.0 was also later prohibited in June 2015.

Image Source: ssl2buy

TLS (Transport Layer Security) is developed by the Internet Engineering Task Force (IETF) as a successor protocol to SSL.

In 1999, TLS 1.0 was designed as another protocol for SSL. Although the differences were not essential, experts stated that SSL 3.0 was less secure than TLS 1.0.

In 2006, TLS 1.1 was released. The next version TLS 1.2 released in August 2008. TLS 1.3 was released in August 2018.

TLS – a future enhancement of SSL

SSL uses the Message Authentication (MAC) algorithm; Transport Layer Security (TLS) goes a step further than this and uses keyed-Hashing Message Authentication (HMAC). What does HMAC will do? Well, it generates an identity check same as the MAC but with HMAC, it becomes tougher to break it into. TLS is a venture of Internet Engineering Task Force (IETF).

TLS protocol consists of two different layers of sub-protocols:

• TLS Handshake Protocol: Enables the client and server to authenticate each other and select an encryption algorithm prior to sending the data
• TLS Record Protocol: It works on top of the standard TCP protocol to ensure that the created connection is secure and reliable. It also provides data encapsulation and data encryption services.

Even though TLS 1.3 was first announced in 2014, it was released this April via OpenSSL. The distribution is still not global yet. There are millions of websites that need to upgrade to the latest version.

TLS 1.3 is currently supported in both Chrome (starting release of 66 version) and Firefox (starting with release 60), and in development for Safari and Edge browsers.

Benefits of using TLS 1.3:

•  Faster connections

In the previous versions, two round-trips were needed to establish a secure connection. This process takes place before any actual data is transferred and lasts for hundreds of milliseconds.

With TLS 1.3 there is only one round-trip necessary to create a secure connection. This cuts the encryption latency by half!

TLS 1.3 speeds up the previously established connections even more with so-called “zero-round trip time” (0-RTT) mode. TLS 1.3 “remembers” previously shared keys and allows to send early data when resuming previous sessions.

Unfortunately, 0-RTT could be a potential threat. Attackers could access your 0-RTT communication and duplicate the flight of 0-RTT data. If your pre-shared keys are not expired, the server will accept attacker’s 0-RTT data and respond to it. This is especially dangerous for POST HTTP requests, e.g. “/buy-something”.

In order to prevent any harm, servers that allow 0-RTT should implement the anti-replay mechanism and limit 0-RTT calls to only some requests. Currently, TLS 1.3 does not provide and even cannot provide inherent replay protections for 0-RTT.

• Improved Security

With a “less is more” approach, TLS 1.3 removed broken and vulnerable pieces of the previous protocols. Having done this, TLS 1.3 enhances security and its implementation is much simpler for developers.

Moreover, TLS 1.3 improves the safety of previous connection by securing session resumption with a PFS (Perfect Forward Secrecy) mechanism. Therefore, an attacker won’t be able to decrypt previous traffic even if he gains access to the session encryption key. In other words, all sessions and even session resumptions are individually protected.

Source: Ghacks, Wikipedia, ssl2buy, cdn77,