Internet is data.Zero and some that go back and forth through the network.To be able to use Instagram, watch a video on YouTube and read the news (or this article) it is necessary for that data to travel following some rules. They are the network protocols .Some, such as the Internet Protocol (IP) or the Hypertext Transfer Protocol (HTTP) are quite well-known.Others, like the TLS, are less well-known, but all are fundamental to the proper operation of the internet.
For most transactions online , "it is critical that the information transmitted is not manipulated, falsified or read by someone other than the sender and receiver ", they point out from Internet Engineering Task Force.To this end, the popular SSL protocol (which has been retired for the first TLS a couple of decades ago) has evolved into a new standard .And most of browsers has been quick to adapt.
Internet Engineering Task Force
No, we have not overlooked that of Internet Engineering Task Force without explaining it.The IETF or Internet Engineering Working Group is an open international organization managed and formed by volunteers.I begin as a working group of the Government of United States, but since 1993 it works under the umbrella of the Internet Society (ISOC).
Its function is to develop standards and protocols for the proper functioning of the internet .Correct vulnerabilities, establish communication rules and optimize processes.Your work is open to anyone who wants to participate, including, on everything, to engineers, researchers and representatives of the operators.
Most protocols are specified through the so-called Request for Comments (RFC) .Each RFC includes a series of standards, updates and suggestions developed by a group of experts.And the rest of the community values them.They cannot be changed or deleted.In fact, the web stores more than 9,000 RFCs.More than half the history of the internet.And among them is the evolution of the TLS until it reaches its 1.3 update.
What is TLS 1.3 and why is it important
Transport Layer Secutirty (TLS) is a cryptographic protocol for the security of the transport layer.That is, it is responsible for providing secure communications on the Internet.The first such protocol was launched in 1995.It was version 3.0 of the known SSL (Socket Security Layer).1.0 and 2.0 did not get to see the light.IEFT took only four years to update it, launching the first TLS in 1999.Even so, today, this type of security certificates is still known as SSL, although in practice they are no longer used.
Version 1.1 of the TLS was launched in 2006 and 1.2 two years later .For the last decade it has been the most used security standard for data transport on the Internet.Now, the Group of Internet Engineering Work has published a new update after years of work (almost 30 versions have been published until the end).Its objective is to lay the foundations of a safer and more efficient internet for the next 20 years.
What changes with TLS 1.3
"During the development of TLS 1.3, the cryptography research community was consulted to analyze, improve and validate the safety of TLS 1.3.This included several workshops where researchers were able to present their findings [...] and produced 15 papers highly cited in important academic conferences ", they point out from IETF.After this work, the new standard incorporates important improvements in three areas: privacy, security and performance.
- Privacy .TLS 1.3 encrypts most of the communication establishment process (known as handshake in English).Segun IETF, this improvement Regarding TLS 1.2, it helps to protect the identities of the participants and prevents traffic analysis.
- Security .One of the great TLS 1.2 problems were the existence of obsolete protocols and algorithms.Vulnerabilities such as Logjam and Sweet32 that have led to real attacks.Update 1.3 only works with algorithms without at least known vulnerabilities.
- Performance .For the handshake process, the client and server exchange cryptographic keys and establish communication.This round-trip process is known as roundtrip .TLS 1.3 allows most communications to be established in a single roundtrip , which would greatly reduce communication times.
Which browsers support it
The last fringes of the definition of TLS 1.3 were closed last March. The final version was published on August 3 .Shortly after, Mozilla announced that Firefox already incorporated, since its version 61, one of the last drafts of TLS 1.3.The final version will be supported with Firefox 63, which is scheduled to be launched in October.According to its own data, 5% of the connections established in Firefox are already TLS 1.3.
Something similar happens with Chrome, which also included one of the last drafts of the security protocol in its previous versions.Chrome 70, in beta since last September 13, already supports the final version of TLS 1.3.In addition, Google announced on August 13 that it was going to implement the standard on all its servers (as well as Facebook and Cloudfare).The final version of the protocol is available in both the latest version of Opera (54) and iOS 11 (and the recently released iOS 12) and on MacOS 10.13.
On the contrary, Microsoft has not implemented any of the previous drafts of TLS 1.3 .As they have waited for the final version to be updated, neither Windows nor the Edge browser support the new security protocol.However, they are expected to do so sooner rather than later.In the coming months, it will become the most used protocol.What is a standard for that.
Images | Unsplash/Kevin Ku, Unsplash/Kaur Kristjan, ISOC
Comments
Post a Comment