# TLS (Transport Layer Security, RFC 8446)

<figure><img src="https://3490214077-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAHT7avzIVwxfPJ4pkhhO%2Fuploads%2FMUOOxPPPbSmIZLkye0NU%2Fimage.png?alt=media&#x26;token=94442e78-59ec-4a12-9901-07f8430aa5fa" alt=""><figcaption></figcaption></figure>

Secure communication protocol over TCP/IP.

* Created upon SSL V3 (Secure Sockets Layer).
* Manages per-application secure sessions over TCP/IP.
  * Initially conceived for HTTP traffic.
  * Used for other traffic types.

There is a similar version for UDP (DTLS, RFC 6347).

Security mechanisms.

* Communication confidentiality and integrity.
  * Key distribution.
* Authentication of communication endpoints.
  * Servers (or, more frequently, services).
  * Client users.
  * Both with asymmetric key pairs, typically with certified public keys.

## Interaction diagram

<figure><img src="https://3490214077-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAHT7avzIVwxfPJ4pkhhO%2Fuploads%2FePdXvjmhN2bdPkaoqGz2%2FScreenshot%20from%202024-04-08%2017-21-39.png?alt=media&#x26;token=9ab57a8e-deca-4cb1-a9e3-db517b2fbac0" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3490214077-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAHT7avzIVwxfPJ4pkhhO%2Fuploads%2FJITR9ARvqzuJ8NMKLkwP%2FScreenshot%20from%202024-04-08%2017-22-02.png?alt=media&#x26;token=322cf097-21e4-428a-af5d-82e4508a0c5e" alt=""><figcaption></figcaption></figure>

## Ciphersuites

If a server supports a single algorithm, it is not expected for all clients to also support it.

* More powerful/limited, older/newer.

The Ciphersuite concept allows the negotiation of mechanisms between client and server.

* Both send their supported ciphersuites, and select one they both share.
* TLS v1.3: O servido escolhe.

Example: ECDHE-RSA-AES128-GCM-SHA256.

Format:

* Key negotiation algorithm: ECDHE.
* Authentication algorithm: RSA.
* Cifra algorithm, and cipher mode: AES-128 GCM.
* Integrity control algorithm: SHA256.
