TLS and SSL encryption explained

TLS encryption (Transport Layer Security) protects data travelling between two devices, such as your browser and a website. It does three jobs: it encrypts the data so no one in between can read it, it checks the data has not been changed on the way, and it uses a certificate to prove the server is who it claims to be. HTTPS is simply HTTP sent through TLS, and it is what the padlock in your browser's address bar means.

SSL vs TLS

SSL (Secure Sockets Layer) was the original protocol. TLS replaced it, and every version of SSL is now officially retired as insecure. People still say "SSL certificate" out of habit, but any secure site today uses TLS.

Symmetric and asymmetric encryption

TLS uses both kinds of encryption, each for what it does best.

• Symmetric encryption uses one shared key to encrypt and decrypt. It is very fast, so TLS uses it, typically with AES, for all the actual data. The problem is how both sides get the same key without anyone else seeing it.
• Asymmetric (public key) encryption uses a pair of keys: a public key anyone can have and a private key the owner keeps secret. What one key locks, only the other can unlock. It is much slower, so TLS uses it only at the start, to agree the shared key and to prove identity.

The TLS handshake

Before any page is sent, the browser and server run a short handshake. In TLS 1.3 it takes one round trip:

1. Client hello. The browser lists the encryption methods it supports and sends its share of a key exchange.
2. Server hello. The server picks a method, sends its own key share, and sends its certificate along with a digital signature made with its private key.
3. Check the certificate. The browser checks that the certificate is for this domain, has not expired, and is signed by a certificate authority (CA) it trusts. It uses the server's public key to check the signature, which proves the server holds the matching private key.
4. Shared key. Both sides combine the key shares to calculate the same secret, which never crossed the network. From it they derive the symmetric keys.
5. Encrypted data. Everything from here on, including your request and the page, is encrypted with those keys and checked so any tampering is spotted.

Certificates and certificate authorities

A certificate links a domain name to a public key. It is signed by a certificate authority, a company your browser or operating system already trusts, after the CA has checked that whoever asked for it really controls the domain. Anyone could create a key pair, so the CA's signature is what stops an attacker pretending to be your bank. Free certificates are available from Let's Encrypt, and many hosting platforms set them up automatically, as the Hosting & Deployment course shows.

Test yourself on certificates and HTTPS, then press Mark to check your answer in the course:

How two strangers agree a secret key

The key exchange in step 4 uses a method called Diffie-Hellman. Here it is with tiny numbers so you can follow it; real TLS uses numbers hundreds of digits long, or elliptic curves, which do the same job with shorter keys.

1. Both sides publicly agree on a prime p = 23 and a base g = 5. Anyone can see these.
2. The browser secretly picks a = 6. The server secretly picks b = 15.
3. The browser sends A = g^a mod p = 5⁶ mod 23 = 8. The server sends B = 5¹⁵ mod 23 = 19. An eavesdropper sees 8 and 19.
4. The browser works out B^a mod p = 19⁶ mod 23 = 2. The server works out A^b mod p = 8¹⁵ mod 23 = 2.

Both get the shared secret 2, because raising g to b then a is the same as raising it to a then b. The eavesdropper knows 23, 5, 8 and 19, but to find the secret they would need a or b, and working backwards from g^a mod p is the discrete logarithm problem, which is impossibly slow with real-sized numbers.

TLS 1.3 makes fresh key shares for every connection. So even if a server's private key is stolen later, recorded conversations cannot be decrypted. This is called forward secrecy.

What TLS does and does not protect

• Protected: the page contents, what you type into forms, passwords, cookies and the full web address after the domain name.
• Not hidden: which server you connect to. Your internet provider can still see that you visited a site, even if not what you did there.
• Not a guarantee the site is honest. A padlock only means the connection is encrypted and the certificate matches the domain. A scam site can have a valid certificate too, so check the address itself.

Common mistakes

• Saying websites use SSL. They use TLS. "SSL certificate" is just the old name.
• Thinking TLS uses public key encryption for everything. It is only used in the handshake. The data itself uses fast symmetric encryption.
• Saying the padlock means a site is safe. It means the connection is private and the certificate matches, not that the owner is trustworthy.
• Saying the shared key is sent across the network. Each side calculates it; it never travels.

Read next

Computer Science · Cyber securityWhat is data encryption? How it works, with examplesWhat data encryption is, how plaintext becomes ciphertext with a key, Caesar and one-time pad examples, symmetric vs public key encryption, and its uses.