Transport Layer Security (TLS): 101

How does TLS affect web application performance? (2)

1) Because of the complex process involved in setting up a TLS connection, some load time and computational power must be expended. 2) The client and server must communicate back and forth several times before any data is transmitted, and that eats up precious milliseconds of load times for web applications, as well as some memory for both the client and the server.

The TLS handshake establishes a? (!)

1) Cypher suite for each communication session.

There are three main components to TLS: (3)

1) Encryption, 2) Authentication, and 3) Integrity.

What's the difference between TLS and HTTPS? (2)

1) HTTPS is an implementation of TLS encryption on top of the HTTP protocol, which is used by all websites as well as some other web services. 2) Any website that uses HTTPS is therefore employing TLS encryption.

TLS Authentication Public Keys' One-Way Encryption analogy?

1) Kind of like the tamper-proof foil found on a bottle of aspirin; 2) The consumer knows no one has tampered with their medicine because the foil is intact when they purchase it.

TLS Authentication Public Keys' One-Way Encryption (sequence)?

1) Once data is encrypted and authenticated, it is then 2) Signed with a message authentication code (MAC). 3) The recipient can then verify the MAC to ensure the integrity of the data.

What's the difference between TLS and SSL? (2)

1) TLS evolved from a previous encryption protocol called Secure Socket Layer (SSL), which was developed by Netscape. 2) TLS version 1.0 actually began development as SSL version 3.1, but the name of the protocol was changed before publication in order to indicate that it was no longer associated with Netscape. Because of this history, the terms TLS and SSL are sometimes used interchangeably.

A TLS connection is initiated using a sequence known as? (1)

1) The TLS handshake.

The most recent version is TLS version? (1)

1.3, which was published in 2018.

The cypher suite established by the TLS handshake is a set of? (1)

Algorithms that specifies details such as which shared encryption keys, or session keys, will be used for that particular session.

TLS Session Resumption technology allows clients and servers that have previously communicated to use? (1)

An abbreviated handshake.

The TLS handshake also handles? (1)

Authentication, which usually consists of the server proving its identity to the client.

A primary use case of TLS is? (1)

Encrypting the communication between web applications and servers, such as web browsers loading a website.

TLS component: Authentication - does? (1)

Ensures that the parties exchanging information are who they claim to be.

TLS component: Encryption - does? (1)

Hides the data being transferred from third parties.

TLS was proposed by the? (1)

Internet Engineering Task Force (IETF), an international standards organization, and the first version of the protocol was published in 1999.

TLS Authentication: Public Keys are? (1)

Keys that use one-way encryption, meaning that anyone can unscramble data encrypted with the private key to ensure its authenticity, but only the original sender can encrypt data with the private key.

What are the technologies in place that help to mitigate the lag created by the TLS handshake? (1)

One technology is TLS False Start, which lets the server and client start transmitting data before the TLS handshake is complete.

How to start implementing TLS on a website? (2 Options)

Option 1: Using popular services like Cloudflare, all users automatically have HTTPS protection from Cloudflare. Via Universal SSL (Cloudflare offers free TLS/SSL certificates to all users) Option 2: Acquire an SSL certificate from a certificate authority, often for a fee, and install the certificate on their origin servers.

TLS can also be used to encrypt? (1)

Other communications such as email, messaging, and voice over IP (VOIP).

TLS is able to set the matching session keys over an unencrypted channel thanks to a technology known as? (1)

Public Key Cryptography

This Authentication during the TLS handshake is done using? (1)

Public keys.

TLS False Start technology lets the server and client?

Start transmitting data before the TLS handshake is complete.

Outside of TLS False Start, another technology to speed up TLS (lag created by the TLS handshake) is? (1)

TLS Session Resumption, which allows clients and servers that have previously communicated to use an abbreviated handshake.

How does TLS work? (1)

TLS can be used on top of a transport-layer security protocol like TCP.

What is Transport Layer Security (TLS)? (1)

Transport Layer Security, or TLS, is a widely adopted security protocol designed to facilitate privacy and data security for communications over the Internet.

TLS component: Integrity - does? (1)

Verifies that the data has not been forged or tampered with.