TLS (Transport Layer Security).

TLS sits between an application protocol (HTTP, SMTP, IMAP, gRPC, etc.) and the transport (typically TCP, or UDP for QUIC), turning a plain bidirectional stream into an authenticated, encrypted channel. A handshake authenticates the server (and optionally the client) via X.509 certificates, negotiates a cipher suite, and derives session keys, usually with elliptic-curve Diffie–Hellman (ECDHE) to provide forward secrecy so that a later key compromise cannot decrypt captured traffic.

Versions. TLS 1.2 (RFC 5246, 2008) and TLS 1.3 (RFC 8446, 2018) are the versions in active use. TLS 1.3 removes legacy ciphers (RC4, CBC-mode, static RSA key exchange), collapses the handshake to a single round trip, and adds optional 0-RTT resumption. SSL 2.0/3.0 and TLS 1.0/1.1 were formally deprecated by RFC 8996 (2021).

Real weaknesses. TLS security often fails in implementation, not design. Heartbleed (CVE-2014-0160) let attackers read OpenSSL server memory — including private keys — via a malformed heartbeat request. POODLE (CVE-2014-3566) exploited SSL 3.0 CBC padding; BEAST (CVE-2011-3389) and Lucky Thirteen (CVE-2013-0169) attacked TLS 1.0 CBC modes. These drove adoption of TLS 1.2+ with AEAD ciphers such as AES-GCM and ChaCha20-Poly1305.

Defences. Disable obsolete versions and ciphers, deploy OCSP stapling and Certificate Transparency, enforce HSTS, rotate keys, and adopt mutual TLS for service-to-service and zero-trust designs.

flowchart TD
  A[Client Hello: versions + cipher list + key share] --> B[Server]
  B --> C[Server Hello: chosen suite + key share]
  C --> D[Server sends X.509 certificate chain]
  D --> E[Client validates chain against trusted CA]
  E --> F[ECDHE exchange derives shared secret]
  F --> G[Both sides derive session keys]
  G --> H[Encrypted application data: AES-GCM / ChaCha20-Poly1305]