CyberStack

Knowledge / network concepts crypto acsc-glossary

Transport Layer Security (TLS)

The S in HTTPS. Stops eavesdropping, tampering, and forgery on the wire. TLS 1.3 is the current protocol.

IN TRANSIT vs AT RESTIn transitTLS 1.2+ / mTLSAt restdisk / object / appKeys are the asset. Encryption with the key next to the data is theatre.

TLS lets client and server applications talk over a network in a way designed to prevent eavesdropping, tampering, and message forgery. That is the IETF wording in RFC 8446, not a marketing line. HTTPS is HTTP running over that layer. SSL is retired language and retired crypto. A padlock on a phishing site still encrypts the theft.

TLS 1.3 (RFC 8446, August 2018) is the current protocol. It uses only authenticated encryption with associated data (AEAD), and it requires forward secrecy through ephemeral key exchange. Static RSA key transport, RC4, and CBC-mode suites from older TLS are gone. The handshake is one round trip. You still have to turn off the old versions on the server, or the standard does not help you.

What you actually configure: TLS 1.3 where clients allow it, TLS 1.2 only as a compatibility floor, certificates you rotate, HSTS where it fits. Cipher suites you will see in the wild are AES-GCM and ChaCha20-Poly1305. The protocol is not the certificate lifecycle. Expired, mis-issued, or unused certificates are an operations problem, not an algorithm problem.

See also: HTTP Strict Transport Security, Mutual TLS (mTLS).

Fact source: IETF RFC 8446, TLS 1.3.