TLS 1.3: The Latest Version SSL/TLS Protocol

Everything to Know About the Latest TLS 1.3 Protocol

TLS 1.3 is the most advanced and secure version of the transport layer security protocol. Check out our guide for an overview of what it offers and how to use it!

Transport Layer Security or TLS is the successor internet security protocol of SSL (Secure Socket Layer). SSL was developed and released in 1994 and became the standard for protecting sensitive information while users browse the internet.

Currently under the control of the Internet Engineering Task Force (IEFT), which has renamed the SSL to TLS and released the first iteration — version 1.0 in 1990. The protocol then evolved with each subsequent release such as TLS 1.1 in 2006, TLS 1.2 in 2008, and TLS 1.3 in 2018.

The latest TLS version 1.3 includes a myriad of improvements such as a new TLS 1.3 handshake and revamped cipher suites. Before we get to know what else it includes, let’s first understand what TLS and TLS 1.3 versions mean:

What is TLS 1.3?

TLS protocols provide secure communication between a web server and the browser of the user. Since the protocol uses symmetric cryptography to encrypt transmitted data, the connection between the two is always secure.

In simple terms, TLS is a standard protocol used for safeguarding communication over the internet. TLS 1.3 is the latest version of this internet security protocol that offers unparalleled privacy and performance than its predecessors. The engineers at Cloudflare have significantly contributed to the development of the newest TLS protocol.

TLS 1.3 was released after almost a decade of its previous version i.e. TLS 1.2 and took almost 28 drafts to be defined by the IEFT. Initially, there were many challenges such as middleboxes, commercial elements, and others that undermine the standard.

From the first draft released in 2014 to the last draft released in 2018, all were tested by stakeholders such as Google, Cloudflare, Mozilla, and others. They all tested TLS 1.3 protocol by adding it to their list of supported protocols and notified the issues they encountered during the review.

The first draft of the TLS 1.3 was released on 17th April 2014, while the final draft of TLS 1.3 release date is 21st March 2018.

TLS 1.2 vs 1.3 Protocol

The major benefit of TLS 1.3 over 1.2 is improved security and faster speed. Apart from that, TLS 1.3 has also come up with several out-of-the-box improvements compared to its predecessor. Further, the addition of 0-RTT has streamlined the SSL/TLS handshake process in TLS 1.3.

Here’s a detailed comparison of TLS 1.2 vs TLS 1.3 Protocol:

TLS 1.2 Protocol	TLS 1.3 Protocol
It has a slow and complex handshake process	TLS 1.3 handshake is faster and simpler
Various messages need to be sent back and forth between the client and server before a connection is established.	When using TLS 1.3, only one round trip is needed, which makes things more simplified.
Here, to verify the identity of the server, the client would check the server’s certificate with a list of well-known and trusted root certificates.	Here, to confirm that the certificate is authentic and hasn’t been revoked by the Certificate Authority, a new client feature called “Certificate Transparency” is employed.
The cipher suites are less secure in TLS 1.2	The TLS 1.3 cipher suites are more secure
The round trip time in TLS 1.2 is greater than 0	The round trip time in TLS 1.3 is 0
Typical handshake in TLS 1.2 involves 5 to 7 packets	TLS 1.3 involves the exchange of 0 to 3 packets for TLS handshake
Connection in TLS 1.2 is slow and less responsive	TLS 1.3 has the fast and responsive connection
TLS 1.2 offers poor user experience and website performance	TLS 1.3 offers a great experience and website performance

Benefits and Features of TLS 1.3

Fundamentally, a security protocol such as TLS 1.3 is judged by the security and latency they offer. Here, we explain the major benefits and features of TLS 1.3:

1. Improved Speed

TLS 1.3 is believed to be much faster than all its previous versions because of the significantly reduced time taken for the handshake. TLS 1.3 takes one round trip to complete a handshake, which reduces the number of round trips required in 1.2. In TLS 1.2, it takes two full round trips for the handshake.

Further, 4 numbers of negotiations are required in TLS 1.2 whereas the same for TLS 1.3 is 2. Thanks to ‘Zero Round Trip Time Resumption’ (0-RTT), it makes TLS 1.3 faster, which is noticeable on a mobile connection.

2. Improved Security

TLS 1.2 had several flaws and weaknesses that enabled vulnerabilities such as POODLE, Heartbleed, or ROBOT to cause havoc on the internet. These vulnerabilities have exploited the flaws that exist in TLS 1.2 such as some outdated ciphers and algorithms. Due to this, cybercriminals could downgrade attacks to steal and tamper with the information.

TLS 1.3 possibly eliminates this as it does not include such vulnerabilities and has introduced secure ciphers and algorithms. In TLS 1.3, the following ciphers and algorithms are discontinued:

• RC4 Stream Cipher
• SHA-1 Hash Function
• CBC Mode Ciphers
• RSA Key Transport
• MD5 Algorithm
• Various Diffie-Hellman Groups
• Export-strength ciphers
• 3DES
• DES

3. Improved Latency

Everyone is aware of how great HTTPS is and how it should be used. But, there is just one factor that is against HTTPS in terms of the counterarguments, and that is speed. The SSL/TLS handshake adds authentication and encryption, which dramatically lengthens the time it takes to connect a server and client.

Although the delay may be little than half a second, it may have a significant effect on vectors like stock trading. With its modified handshake, TLS 1.3 significantly lowers latency. This is due to the fact that TLS 1.2 requires two round trips of communication between the client and server while TLS 1.3 handshake only requires one.

This significantly reduces the TTFB (time to the first byte) as result. The 0-RTT handshake is another fantastic feature that is scheduled for rollout. Simply put, the handshake won’t have a single round trip. You heard it right, absolutely no round-trips! This is because the client and the server have already communicated with each other.

4. Simplified Cipher Suite

As mentioned earlier, the TLS 1.3 protocol has eliminated half the negotiation from the handshake, which also decreased the size of the cipher. TLS 1.2 and older versions used Cipher Suites with 4 ciphers as followed:

The cipher suites supported by TLS 1.3 do not include key exchanges and signature algorithms.

The TLS 1.2 had the biggest drawback of multiple cipher combinations for participants of handshakes and lagged behind in providing guidance for choosing suitable cipher suites. However, TLS 1.3 offers five different cipher suites:

• TLS_AES_256_GCM_SHA384
• TLS_CHACHA20_POLY1305_SHA256
• TLS_AES_128_GCM_SHA256
• TLS_AES_128_CCM_8_SHA256
• TLS_AES_128_CCM_SHA256

TLS 1.3 Browser and Server Support

TLS 1.3 support has been included in the majority of browsers and servers after it was released. Google Chrome has been shipping its browser with the initial draft version of TLS 1.3 since Chrome 65. And in Chrome 70, the final version of TLS 1.3 was supported for outgoing connections.

Also, Firefox 52 included support for the draft version of TLS 1.3, and Firefox 63 shipped with the final version of TLS 1.3. Following the suite, Microsoft Edge also included support for TLS 1.3 starting with version 76. Safari 12.1 version for the macOS 10.14.4 has by default enabled support for TLS 1.3.

To know if your server supports the TLS 1.3 version, you can simply use any SSL server test tool. Scan your domain using the tool to know if your server has enabled support for TLS 1.3 or not.

Final Words

So, to answer if TLS 1.3 is secure, it’s the most recent and secure version of the TLS internet security protocol. The protocol is designed to improve the security and privacy of online communication and data transmission.

With its enhanced key exchange algorithm, faster handshakes, and stronger encryption, TLS 1.3 offers a significant improvement over its predecessors. It also addresses vulnerabilities that exist in TLS 1.2, making it a highly recommended upgrade for web browsers and servers.

As mentioned, TLS 1.3 is supported by the majority of browsers including Chrome, Firefox, MS Edge, Safari, and others. While TLS 1.3 may require some adjustments for website administrators and application developers, its benefits in terms of security and privacy make it a worthwhile investment.