TLS Versions, Cipher Suites, and Perfect Forward Secrecy

TLS (Transport Layer Security) is the cryptographic protocol that secures the majority of internet communications — HTTPS, SMTPS, IMAPS, LDAPS, and VPNs all rely on TLS. TLS provides three security properties: confidentiality (encryption prevents eavesdropping), integrity (MAC prevents tampering), and authentication (certificates verify server identity). TLS evolved from SSL (Secure Sockets Layer), which is now deprecated. The current versions are TLS 1.2 (widely deployed) and TLS 1.3 (faster and more secure, recommended for all new deployments).

TLS has gone through several versions, with older ones containing critical vulnerabilities. SSL 2.0/3.0: deprecated, vulnerable to POODLE, DROWN attacks. TLS 1.0: deprecated by NIST and PCI-DSS in 2020 (vulnerable to BEAST, POODLE on block ciphers). TLS 1.1: deprecated alongside TLS 1.0. TLS 1.2: current minimum standard; secure when properly configured with strong cipher suites. TLS 1.3: released 2018; removes all weak algorithms, mandatory forward secrecy, significantly faster handshake (1-RTT instead of 2-RTT), and prevents downgrade attacks. PCI-DSS 4.0 requires TLS 1.2 minimum, recommends 1.3.

A cipher suite is a set of cryptographic algorithms used together in a TLS session. Each cipher suite specifies: a key exchange algorithm (how session keys are established), an authentication algorithm (how the server is verified), a bulk encryption algorithm (what encrypts the data), and a message authentication code (MAC) algorithm (how integrity is verified). The client and server negotiate which cipher suite to use during the TLS handshake — the server selects the strongest suite that both parties support.

The key exchange phase establishes the session key without transmitting it. RSA key exchange (TLS 1.2): the client encrypts a premaster secret with the server's public key — if the private key is later compromised, all past sessions can be decrypted. DHE (Diffie-Hellman Ephemeral): generates a new key pair for each session; provides forward secrecy but is slow. ECDHE (Elliptic Curve DHE): achieves the same forward secrecy as DHE but with smaller key sizes and better performance — this is the preferred key exchange in both TLS 1.2 and TLS 1.3. TLS 1.3 mandates ECDHE or DHE, removing RSA key exchange entirely.

Perfect Forward Secrecy (PFS) ensures that even if the server's long-term private key is later compromised, past recorded sessions cannot be decrypted. PFS is achieved by using ephemeral key exchange (ECDHE or DHE) where a fresh temporary key pair is generated for each session and discarded after use. Without PFS (RSA key exchange), an attacker can record all encrypted TLS sessions today, then decrypt them retroactively when they eventually obtain the private key. The NSA's 'collect now, decrypt later' surveillance strategy assumes targets will eventually upgrade to stronger keys or quantum computers will break current ones.

Several legacy cipher components are cryptographically broken and must be disabled. NULL ciphers: no encryption at all. Export-grade ciphers (FREAK attack): deliberately weakened to comply with 1990s US export regulations. RC4: stream cipher with statistical biases exploited in attacks. DES and 3DES: block ciphers with too-small block sizes (SWEET32 attack) or insufficient key lengths. MD5 and SHA-1 for MACs: collision vulnerabilities. Anonymous ciphers (aNULL): no server authentication. Modern TLS configurations should only allow AES-GCM, ChaCha20-Poly1305, AES-CCM as bulk ciphers.

TLS 1.3 makes several significant security improvements over 1.2. Mandatory PFS: RSA key exchange is removed — all sessions use ECDHE or DHE. Fewer cipher suites: only 5 AEAD cipher suites are permitted; no weak cipher negotiation is possible. Faster handshake: 1 round-trip (1-RTT) vs 2-RTT in TLS 1.2, and 0-RTT for session resumption (though 0-RTT has replay attack considerations). Encrypted handshake: the server certificate is encrypted in the handshake, preventing passive observers from identifying which certificate (and therefore which website) the client is connecting to.

Downgrade attacks trick a TLS server and client into using an older, weaker TLS version or cipher suite than both support. POODLE (Padding Oracle On Downgraded Legacy Encryption) exploited the fact that TLS implementations would fall back to SSL 3.0 on connection errors. The mitigation was disabling SSL 3.0. FREAK and Logjam exploited export-grade ciphers. TLS_FALLBACK_SCSV is a pseudo-cipher suite that clients include to signal 'this is not my preferred version' — if a server sees it and supports a higher version, it aborts the downgrade attempt.

TLS server authentication relies on the client verifying the server's certificate chain back to a trusted root CA. Critical checks: expiry (certificate must be within validity period), revocation (CRL or OCSP check confirms cert is not revoked), hostname (SAN or CN must match the domain being connected to), and signature chain (intermediate CA and root CA signatures are valid). Certificate Transparency (CT) requires all publicly trusted certificates to be logged in append-only CT logs, enabling detection of mis-issued certificates within minutes of issuance.

Qualys SSL Labs (ssllabs.com/ssltest) is the gold-standard tool for evaluating a web server's TLS configuration. It grades servers from A+ (excellent) through F (critical issues) based on: supported TLS versions, cipher suite strength, certificate validity, HSTS configuration, forward secrecy support, and resistance to known attacks. An A+ rating requires: TLS 1.2+ only, all ECDHE ciphers, valid certificate, HSTS with preload. Organizations should run SSL Labs tests after initial configuration and again after any changes to the TLS stack. Many compliance frameworks (PCI-DSS) require periodic TLS configuration assessments.

Expired TLS certificates cause outages and user trust warnings that attackers exploit. Certificate lifecycle management involves: tracking all certificates in a certificate inventory, configuring expiry alerts at least 30 days before expiration, automating renewal with ACME protocol (Let's Encrypt, Certbot), using short certificate lifetimes (90 days for public certificates) to reduce the window of risk from compromise, and using wildcard certificates carefully (*.example.com) since a compromised wildcard certificate affects all subdomains. Certificate management platforms (Venafi, DigiCert CertCentral) automate discovery and lifecycle across large certificate inventories.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: TLS 1.0/1.1 are deprecated and TLS 1.2 is the minimum standard while TLS 1.3 is preferred with mandatory PFS and encrypted handshakes, cipher suites specify key exchange (prefer ECDHE), bulk encryption (AES-GCM, ChaCha20), and MAC algorithms, and Perfect Forward Secrecy requires ephemeral (DHE/ECDHE) key exchange so that past sessions cannot be decrypted even after key compromise. Next up we explore secure DNS: DNSSEC and DNS over HTTPS.