An interesting aspect of the 21st century is how much we depend on the internet and other technologies and devices for many activities that involve us passing across personal data and private information. Daily, information is transmitted over the Internet, and it passes through various devices and servers; hence, the need to secure communication and protect data.
In securing the numerous exchange that entail our personal and confidential information, communication between two or more parties is carried out using a tool called encryption. This security tool helps to protect sensitive data and secure transmission between applications and servers.
In this article, we’ll be discussing the SSL/TLS security protocol, which operates as part of an encryption process that determines secure communication over a computer network or data exchange between a client and server.
Let’s dive right in!
What is Encryption, and Why is it Important?
Encryption involves encoding or concealing data to make it inaccessible to unauthorized users. Essentially, it protects users from security risks when performing activities on the internet, such as financial transactions, private messaging, etc.
There are two main methods of encrypting data namely; symmetric and asymmetric encryption.
Symmetric Encryption: This involves using a single key to encrypt and decrypt data. For example, in password-protected zip files - anyone who wants access to the file must have the password.
Asymmetric Encryption: This involves using public and private key pairs to encrypt and decrypt data. For example, your email address - which you can share with people and your email password- that’s for your knowledge only.
Encryption is like a lock with a secret code, and only the person with the right key can unlock the original message. So why would you need a secret code? Reasons would include;
Mitigating data breaches
Data Confidentiality
Secure communication, and
Regulatory compliance
Encryption is like a secret language, and it is crucial, especially because it assists in keeping your data safe from prying eyes.
What is SSL/TLS Security Protocol?
SSL (Security Socket Layer) and its upgraded version, TLS (Transport Layer Security), are protocols that make sure the data transmitted between computers is secure using encryption. Think of SSL/TSL as security guards for your information during online conversations. SSL was first created in 1995, but it had some issues with security. So, it got an upgrade and became TLS, which is the safer and more modern version. In other words, SSL is referring to the TLS security protocol.
The TSL performs tasks such as;
Authentication
Data Integrity and
Data Encryption
Overview of How SSL / TLS Works?
Websites use HTTPS for securing and protecting data. HTTPS means - Hypertext Transfer Protocol Secure - and its primary function is to make sure the communication between you and the website/application is secure and private.
This also means that HTTPS utilizes SSL/TLS encryption, which aims to add an extra layer of protection to your online experience.
The TLS session is a conversation between two parties, like your computer and a website, which consists of the handshake and encryption phases.
However, before we dive into the TLS handshake, let’s get to the basics and understand how TLS works.
During a session—a conversation between the client and server or two entities—the devices exchange identity information; it’s like an introduction, and this exchange secures the conversation, ensuring that both sides are legitimate.
The handshake phase is for authentication because the client has to trust that it’s communicating with a legitimate server. The server provides a TLS certificate to the client as a way to build trust. They also use a public key protocol for authentication during the handshake; a shared secret session key is established for encrypting all ongoing conversations. This secret session key is used to decrypt and encrypt messages between entities.
For instance, in a client-server interaction, messages delivered from the client to the server are encrypted. The server receives the message and checks if any modifications have been made to it during transit; if there are none, it proceeds to decrypt it. The symmetric session key, which is like a special password that was shared during the handshake, is used by the client to encrypt messages and by the server to decrypt messages. Overall, TLS authenticates connections before encrypting data transmitted over a network.
