Web Security Protocols: SSL, TLS, and S-HTTP
When the World Wide Web was first invented, websites used plain HTTP (HyperText Transfer Protocol). In plain HTTP, every password, credit card number, and form you submit travels across the internet in readable Plain Text!
To make online shopping, banking, and web browsing safe, three key security protocols were developed: SSL, TLS, and S-HTTP.
💡 Notice Noticeable in Your Browser:
Whenever you see the Padlock Icon (🔒) andhttps://in the address bar of Chrome or Safari (likehttps://www.campusnotes.in), your browser is using SSL / TLS!
1. Secure Sockets Layer (SSL)
SSL (Secure Sockets Layer) was developed by Netscape in 1994 (SSL v2.0 and v3.0) to provide a secure, encrypted communication channel between a Web Browser (Client) and a Web Server.
Where Does SSL Sit in the TCP/IP Model?
SSL sits right between the Transport Layer (TCP) and the Application Layer (HTTP, SMTP, FTP). Because it works on top of TCP, it can secure HTTP (making it HTTPS), email, and file transfers.
Architecture of SSL (The 4 Sub-Protocols of SSL)
SSL is not a single protocol; it is a two-layered stack of 4 sub-protocols:
- SSL Handshake Protocol:
Allows the browser and web server to authenticate each other (using Digital Certificates), agree on which encryption algorithm to use, and securely generate a shared Session Key before any data is sent. - SSL Change Cipher Spec Protocol:
A simple 1-byte message that tells the other side: “Handshake is finished! From the next packet onwards, everything will be encrypted using our new Session Key.” - SSL Alert Protocol:
Sends warning or fatal error messages if something goes wrong (e.g., “Expired Certificate” or “Bad Record MAC”). - SSL Record Protocol:
Takes application data, breaks it into manageable blocks (Fragmentation), optionally compresses it, attaches a Message Authentication Code (MAC) for integrity, and encrypts it using the symmetric Session Key (like AES).
How the SSL / TLS Handshake Works (In 4 Simple Steps):
Notice how SSL cleverly combines both Asymmetric and Symmetric cryptography:
- Browser says “ClientHello”: Browser connects to
https://amazon.inand lists the encryption algorithms it supports. - Server sends “ServerHello” + Digital Certificate: Amazon’s server replies with its official SSL Certificate containing Amazon’s Public Key.
- Key Exchange (Asymmetric): Your browser verifies the certificate, generates a random Symmetric Session Key, encrypts that key using Amazon’s Public Key, and sends it to Amazon. (Only Amazon’s Private Key can unlock it!).
- Fast Encrypted Communication (Symmetric): Now both your browser and Amazon have the same secret Session Key. All further web pages and credit card details are encrypted rapidly using AES!
2. Transport Layer Security (TLS)
What is TLS?
TLS (Transport Layer Security) is the modern, upgraded, and more secure successor to SSL.
- In 1999, the Internet Engineering Task Force (IETF) took over SSL v3.0, fixed its security vulnerabilities, and standardized it as TLS 1.0.
- Today, all modern websites actually use TLS 1.2 or TLS 1.3 (even though people still casually call it “SSL”).
Comparison: SSL vs. TLS
| Feature | SSL (Secure Sockets Layer) | TLS (Transport Layer Security) |
|---|---|---|
| 1. Full Form | Secure Sockets Layer | Transport Layer Security |
| 2. Developed By | Netscape (1994–1996) | IETF (1999–Present, latest is TLS 1.3) |
| 3. Versions | SSL 1.0, SSL 2.0, SSL 3.0 | TLS 1.0, TLS 1.1, TLS 1.2, TLS 1.3 |
| 4. Security Status | Deprecated / Vulnerable (vulnerable to POODLE attack) | Highly Secure and actively used across the modern web |
| 5. Message Integrity | Uses an older MAC (Message Authentication Code) | Uses the stronger HMAC (Hashed MAC) algorithm |
| 6. Handshake Speed | Slower handshake (requires more round-trips) | TLS 1.3 completes the handshake in just 1 round-trip! |
3. Secure HyperText Transfer Protocol (S-HTTP)
What is S-HTTP?
S-HTTP (Secure HTTP) is an older, alternative web security protocol designed in 1994 by Enterprise Integration Technologies (EIT) as an extension of the HTTP protocol itself.
Crucial Difference: How S-HTTP Differs from HTTPS (HTTP over SSL/TLS)
Students often think S-HTTP and HTTPS are the same thing—they are NOT!
- Analogy:
- SSL/TLS (HTTPS) builds an armored tunnel and sends all your letters through it.
- S-HTTP puts a locked envelope around one specific letter (a single web page or form submission) while leaving the rest of the road normal.
💡 DAVV Exam Preparation Tips
5-Mark / 10-Mark Question: “Write short notes on: (a) SSL (b) TLS (c) S-HTTP. Differentiate between SSL and TLS.”
- Draw the SSL 2-layer architecture (Handshake, Change Cipher Spec, Alert on top of Record Protocol).
- Explain the 4-step SSL Handshake (ClientHello → Server Certificate → Session Key Exchange → Symmetric Encryption).
- Include the SSL vs. TLS table and clearly distinguish S-HTTP (encrypts individual HTTP messages) from HTTPS (encrypts the entire transport session).