SSL/TLS

SSL/TLS
Name	SSL/TLS
Developer	Netscape Communications Corporation, IETF
Initial release	1994
Written in	C, OpenSSL, LibreSSL
Operating system	Cross-platform
License	Various

SSL/TLS

SSL/TLS are cryptographic protocols that provide confidentiality, integrity, and authentication for data transmitted over networks. They are widely used to secure web browsing, email, instant messaging, and other client–server communications between endpoints including browsers by Microsoft, Mozilla Foundation, Google, and servers run by Amazon (company), Cloudflare, and Akamai Technologies. The protocols interoperate with infrastructure managed by organizations such as Internet Engineering Task Force, Certificate Authority Browser Forum, and national regulators in United States, European Union, and China.

Overview

SSL/TLS establish an encrypted channel between a client and a server through a handshake that negotiates cryptographic parameters and authenticates endpoints. Major adopters include Apple Inc., Oracle Corporation, Facebook, Twitter, Netflix, Salesforce, and content-delivery operators like Fastly and Limelight Networks. The protocol suite supports cipher suites combining key exchange, authentication, encryption, and message authentication, with implementations integrated into web servers such as Apache HTTP Server, Nginx, and Microsoft IIS and clients like Google Chrome, Mozilla Firefox, Safari (web browser), and Microsoft Edge.

History and Evolution

Early work on secure network protocols involved actors such as Ericsson, Sun Microsystems, and research from universities including MIT, Stanford University, and University of California, Berkeley. SSL originated in proprietary form at Netscape Communications Corporation in the mid-1990s, influenced by cryptographers including researchers connected to RSA Security and the National Security Agency. The Internet Engineering Task Force standardized successive TLS versions through working groups with participation from IETF, ENISA, IEEE Standards Association, and vendors like Cisco Systems and Juniper Networks. Notable milestones include migrations driven by vulnerabilities disclosed by teams at CISPA, Google Project Zero, and academic groups at University of Oxford, University of Cambridge, and ETH Zurich leading to versions such as TLS 1.0, TLS 1.1, TLS 1.2, and TLS 1.3.

Protocol Architecture and Cryptography

The architecture separates handshake, record layer, and alert protocols; cryptographic choices rely on primitives from standards organizations like National Institute of Standards and Technology and influences from designs by Whitfield Diffie and Martin Hellman in public-key exchange. Key agreement methods include variants developed from Diffie–Hellman key exchange and authenticated by signature schemes using algorithms associated with RSA (cryptosystem), Elliptic-curve cryptography, and research by Daniel J. Bernstein. Symmetric encryption historically used modes based on standards from IEEE, NIST, and cipher designers linked to Advanced Encryption Standard committees; message authentication used constructions such as HMAC defined by researchers at IETF and influenced by work at University of Waterloo. Perfect forward secrecy gained traction through deployments advocated by engineers at Google and Facebook and implemented using ephemeral Diffie–Hellman variants standardised by IETF.

Certificate Authorities and PKI

Public-key infrastructure (PKI) depends on certificate authorities (CAs) such as DigiCert, Let's Encrypt, Symantec (company), GlobalSign, and Entrust. Browser and operating-system vendors—Mozilla Foundation, Microsoft Corporation, Apple Inc.—maintain root stores and policies that affect trust decisions, coordinated with forums like the CA/Browser Forum. Legal and regulatory bodies including European Commission and Federal Trade Commission have influenced disclosure and liability practices. Research by teams at Carnegie Mellon University and Princeton University has analysed CA ecosystems, leading to mechanisms such as certificate transparency logs originated by engineers at Google and audit systems advocated by EFF and Internet Society.

Security Vulnerabilities and Attacks

High-profile attacks and analyses by groups at University of California, Berkeley, Stanford University, and security vendors like Mandiant and Kaspersky Lab uncovered risks such as protocol downgrades, cipher-suite weaknesses, implementation bugs, and misuse of certificates. Incidents involving Heartbleed and disclosures from Google Project Zero and CERT Coordination Center prompted patches in implementations like OpenSSL, LibreSSL, and BoringSSL. Attack classes include man-in-the-middle exploits leveraged in nation-state operations reported by Citizen Lab, surveillance disclosures tied to Edward Snowden, and widespread scanning by organizations such as Shodan. Mitigations have involved deprecation of insecure algorithms, adoption of TLS 1.3, and operational controls by cloud providers like Amazon Web Services and Google Cloud Platform.

Implementations and Applications

Open-source implementations include OpenSSL, GnuTLS, LibreSSL, and BoringSSL used by projects like Linux kernel distributions from Debian and Red Hat. Commercial implementations are supplied by Microsoft, Oracle Corporation, and appliance vendors such as F5 Networks. TLS protects protocols including HTTP used by WordPress, Wikipedia, Stack Overflow, SMTP used by Microsoft Exchange, IMAP used by Dovecot, and application-layer frameworks like Node.js, OpenSSH, and Java Virtual Machine stacks. Content providers and financial institutions including JPMorgan Chase, Goldman Sachs, and PayPal depend on TLS for regulatory compliance and consumer protection.

Standards, Governance, and Interoperability

Standards bodies such as the Internet Engineering Task Force, International Organization for Standardization, and International Telecommunication Union produce specifications and interoperability profiles. Governance involves coordination among vendors including Google, Mozilla Foundation, Microsoft Corporation, and operators like Akamai Technologies through interoperability testing events and test suites maintained by organizations like MITRE and OWASP. International policy influences have involved legislators in United States Congress and institutions like the European Parliament addressing lawful interception, export controls, and privacy legislation that affect deployment choices.

Category:Computer security protocols