What TLS Solves

TLS (Transport Layer Security, the modern SSL) gives applications:

1. Confidentiality: nobody on the wire can read the data.
2. Integrity: nobody can tamper undetected.
3. Authentication: client knows it's talking to the real server (and optionally vice versa).

Without TLS:

• WiFi attackers see your password.
• ISPs inject ads into HTTP.
• Coffee shops MITM your bank session.

TLS sits between TCP and your application. Same socket; encrypted bytes.

Application (HTTP, IMAP, SMTP, ...)
        ↓
   TLS handshake → keys
   TLS record    → AEAD-encrypted chunks
        ↓
TCP / UDP (QUIC)
        ↓
IP

Versions:

• SSL 2.0/3.0: broken, deprecated decades ago.
• TLS 1.0/1.1: deprecated 2020.
• TLS 1.2: still widely deployed.
• TLS 1.3 (2018): modern. Faster, safer, cleaner. What we'll build.

TLS 1.3 dropped 60+ ciphers from 1.2's catalog (RC4, MD5, CBC mode, RSA key exchange, etc.). Everything that's broken or footgun-prone is gone. Result: a much smaller, more analyzable surface.

Key changes from 1.2:

• 1-RTT handshake (was 2-RTT).
• 0-RTT for resumption (instant reconnects).
• Forward secrecy mandatory (ephemeral DH).
• Cipher suites simplified to (AEAD, hash) pairs.
• Server certificate sent encrypted (privacy).