{"id":2357,"date":"2020-04-03T05:41:39","date_gmt":"2020-04-03T05:41:39","guid":{"rendered":"http:\/\/kusuaks7\/?p=1962"},"modified":"2023-12-20T18:32:57","modified_gmt":"2023-12-20T18:32:57","slug":"tls-1-3-everything-possibly-needed-know","status":"publish","type":"post","link":"https:\/\/www.experfy.com\/blog\/iot\/tls-1-3-everything-possibly-needed-know\/","title":{"rendered":"TLS 1.3: Everything you need to know"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"2357\" class=\"elementor elementor-2357\" data-elementor-post-type=\"post\">\n\t\t\t\t\t\t<section class=\"has_eae_slider elementor-section elementor-top-section elementor-element elementor-element-6069140f elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"6069140f\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"has_eae_slider elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-2d3f9d9\" data-id=\"2d3f9d9\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-b25216d elementor-widget elementor-widget-heading\" data-id=\"b25216d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\"><h3 style=\"color: #aaa;font-style: italic\">TLS 1.3 has myriad improvements over its predecessors, including a new handshake and revamped cipher suites.<\/h3><\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6e15f68 elementor-widget elementor-widget-text-editor\" data-id=\"6e15f68\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tBefore anyone points out that the IETF published TLS 1.3 as RFC 8446 almost a year ago \u2013 we know.\u00a0<a href=\"https:\/\/www.thesslstore.com\/blog\/tls-1-3-approved\/\" rel=\"noopener\">We covered that<\/a>. But we realized we hadn\u2019t done an in-depth explainer of the new protocol version yet, and given the number of questions we field about TLS 1.3 on a regular basis \u2013 we thought maybe this would be a good time.\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-bdc160c elementor-widget elementor-widget-text-editor\" data-id=\"bdc160c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tTechnically, TLS 1.3 is the seventh iteration of the SSL\/TLS protocol. SSL 1.0 was never officially released, 2.0 and 3.0 were short-lived (<a href=\"https:\/\/www.thesslstore.com\/blog\/nearly-21-of-the-worlds-top-100000-websites-still-arent-using-https\/\" rel=\"noopener\">albeit not entirely dead yet<\/a>). And then TLS 1.0 was introduced as a replacement to SSL. There were some technical differences between SSL and TLS \u2013 namely, at first, whether the connection began by port or by protocol \u2013 but the premise was largely the same. TLS 1.0 was replaced by 1.1, which was succeeded by TLS 1.2 two years later in 2008.\u00a0<a href=\"https:\/\/www.thesslstore.com\/blog\/tls-1-3-approved\/\" rel=\"noopener\">TLS 1.3 was finalized last Summer<\/a>.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9f27bc9 elementor-widget elementor-widget-text-editor\" data-id=\"9f27bc9\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tWhile, intuitively it would seem that the biggest difference between two successive protocol versions would be the switch from SSL 3.0 to TLS 1.0, it\u2019s probably fair to argue that TLS 1.3 is far more different from TLS 1.2 than 1.0 is from SSLv3.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9cbb01e elementor-widget elementor-widget-text-editor\" data-id=\"9cbb01e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\nSo, today we\u2019re going to take a look at what exactly has changed in TLS 1.3 and what benefits those changes bring to security and performance on the web.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9e16560 elementor-widget elementor-widget-text-editor\" data-id=\"9e16560\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tLet\u2019s hash it out.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-88e8d71 elementor-widget elementor-widget-heading\" data-id=\"88e8d71\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\"><h2>TLS 1.3: 10 years in the making<\/h2><\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9c581b4 elementor-widget elementor-widget-text-editor\" data-id=\"9c581b4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tTLS 1.3 (<a href=\"https:\/\/datatracker.ietf.org\/doc\/rfc8446\/?include_text=1\" rel=\"noopener\">RFC 8446<\/a>) was released a full decade after TLS 1.2 and took 28 drafts to finally define. It was not always smooth sailing, either. There were problems with middleboxes, there were commercial elements looking to undermine the standard in the interest of traffic inspection.\u00a0<a href=\"https:\/\/www.thesslstore.com\/blog\/tls-1-3-banking-industry-working-undermine-encryption\/\" rel=\"noopener\">Namely, the financial industry<\/a>. Additionally, the vetting process takes an eternity when there are this many stakeholders involved.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-af8d319 elementor-widget elementor-widget-image\" data-id=\"af8d319\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/TLS-versioning-3-1024x142.png\" alt=\"\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"has_eae_slider elementor-section elementor-top-section elementor-element elementor-element-cae74b7 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"cae74b7\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"has_eae_slider elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-5c967ad\" data-id=\"5c967ad\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-d7823b6 elementor-widget elementor-widget-text-editor\" data-id=\"d7823b6\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tFrom the first TLS 1.3 version released on April 17, 2014, all the way to the 28th and final version, these drafts were continuously tested and reviewed by vendors such as Google, Cloudflare, Mozilla, and many others. They would experiment with adding TLS 1.3 support, test it, and report issues as they discovered them. That wasn\u2019t always smooth sailing either. For instance, in February 2017, a proxy issue forced\u00a0<a href=\"http:\/\/searchsecurity.techtarget.com\/news\/450413934\/Chrome-backs-out-of-TLS-13-support-after-proxy-issues\" rel=\"nofollow noopener\">Google to back out of TLS 1.3 support<\/a>\u00a0entirely for a little while. Obviously, that caused a delay.\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3eeec53 elementor-widget elementor-widget-text-editor\" data-id=\"3eeec53\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tThat early testing by major tech players has actually come back to cause it\u2019s share of problems now that TLS 1.3 is finalized, too. We\u2019ll get to that in a minute.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-fb85842 elementor-widget elementor-widget-heading\" data-id=\"fb85842\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\"><h2>TLS 1.2 vs. TLS 1.3 \u2013 What\u2019s the difference?<\/h2><\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-fd75c27 elementor-widget elementor-widget-text-editor\" data-id=\"fd75c27\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tTLS 1.2 has been serving the internet faithfully for a decade now, yet nearly\u00a0<a href=\"https:\/\/www.thesslstore.com\/blog\/nearly-21-of-the-worlds-top-100000-websites-still-arent-using-https\/\" rel=\"noopener\">25% of the Alexa Top 100,000 still doesn\u2019t support it<\/a>. That\u2019s problematic, because making the jump from TLS 1.2 to to TLS 1.3 is already a fairly large change. Upgrading from even older protocols will require even more configuration.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6d3cd6d elementor-widget elementor-widget-text-editor\" data-id=\"6d3cd6d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\nNow, that\u2019s not to imply upgrading is prohibitively difficult, it\u2019s more to illustrate that one of the biggest challenges that\u2019s going to face TLS 1.3, at least for the next year or so, is the rate of adoption.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-aa36527 elementor-widget elementor-widget-text-editor\" data-id=\"aa36527\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>As of the end of last year, just over 17% of the Alexa Top 100,000 supported TLS 1.3.<\/p>\n<p><br><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-61f5f34 elementor-widget elementor-widget-image\" data-id=\"61f5f34\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/Version-Support-2-1024x583.png\" alt=\"\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d9a61f8 elementor-widget elementor-widget-text-editor\" data-id=\"d9a61f8\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tThat number has undoubtedly grown since then, but we\u2019re still a long ways from widespread adoption.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-71acad4 elementor-widget elementor-widget-text-editor\" data-id=\"71acad4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tOk, now let\u2019s look at some of the differences. TLS 1.3\u2026\n<ul>\n \t<li>Eliminates support for outmoded algorithms and ciphers<\/li>\n \t<li>Eliminates RSA key exchange, mandates Perfect Forward Secrecy<\/li>\n \t<li>Reduces the number of negotiations in the handshake<\/li>\n \t<li>Reduces the number of algorithms in a cipher suite to 2<\/li>\n \t<li>Eliminates block mode ciphers and mandates AEAD bulk encryption<\/li>\n \t<li>Uses HKDF cryptographic extraction and key derivation<\/li>\n \t<li>Offers 1-RTT mode and Zero Round Trip Resumption<\/li>\n \t<li>Signs the entire handshake, an improvement of TLS 1.2<\/li>\n \t<li>Supports additional elliptic curves<\/li>\n<\/ul>\nWe\u2019re not going to go point-by-point, but let\u2019s take a closer look at the biggest updates in TLS 1.3.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c7ff200 elementor-widget elementor-widget-heading\" data-id=\"c7ff200\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\"><h2>TLS 1.3 Eliminated Vulnerable Algorithms and Ciphers<\/h2><\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f7a3488 elementor-widget elementor-widget-text-editor\" data-id=\"f7a3488\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tTime is the enemy of any cryptosystem.\u00a0<a href=\"https:\/\/www.thesslstore.com\/blog\/the-great-cipher\/\" rel=\"noopener\">Always has been<\/a>,\u00a0<a href=\"https:\/\/www.thesslstore.com\/blog\/post-quantum-encryption\/\" rel=\"noopener\">always will be<\/a>. Over time, vulnerabilities and exploits are found that make continued use of a given algorithm or cryptosystem a potential risk.\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0beba47 elementor-widget elementor-widget-text-editor\" data-id=\"0beba47\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tNow, let\u2019s address something that I feel gets left out of a lot of discussions about vulnerabilities and potential attacks: many of these are prohibitively difficult for all but the most sophisticated actors to pull off. When an issue really is pressing, like Heartbleed \u2013 which was actually pulled off successfully in the wild \u2013 it gets the attention it deserves. But a lot of others, like\u00a0<a href=\"https:\/\/www.thesslstore.com\/blog\/zombie-poodle-and-goldendoodle-two-new-exploits-found-for-tls-1-2\/\" rel=\"noopener\">POODLE<\/a>, are demonstrated by researchers in proof-of-concepts and really aren\u2019t the immediate threats they\u2019re made out to be.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8ac458e elementor-widget elementor-widget-text-editor\" data-id=\"8ac458e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tThat\u2019s not to say they shouldn\u2019t dealt with swiftly, just that the alarm doesn\u2019t need to be raised so high.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-94fa622 elementor-widget elementor-widget-text-editor\" data-id=\"94fa622\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tAnyways, TLS 1.3 has eliminated support for algorithms and ciphers that are both theoretically and practically vulnerable. This includes:\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c3c4597 elementor-widget elementor-widget-image\" data-id=\"c3c4597\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/Old-algorithms-233x300.png\" alt=\"\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e18bbca elementor-widget elementor-widget-text-editor\" data-id=\"e18bbca\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<ul>\n \t<li>RC4 Stream Cipher<\/li>\n \t<li>RSA Key Exchange<\/li>\n \t<li>SHA-1 Hash Function<\/li>\n \t<li>CBC (Block) Mode Ciphers<\/li>\n \t<li>MD5 Algorithm<\/li>\n \t<li>Various non-ephemeral Diffie-Hellman groups<\/li>\n \t<li>EXPORT-strength ciphers<\/li>\n \t<li>DES<\/li>\n \t<li>3DES<\/li>\n<\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c74630c elementor-widget elementor-widget-heading\" data-id=\"c74630c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\"><h2>Simplified Key Exchange<\/h2><\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9f15106 elementor-widget elementor-widget-text-editor\" data-id=\"9f15106\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tHistorically, there have been two popular mechanisms for exchanging the secure session key that will be used during the HTTPS connection following the handshake:\n<ul>\n \t<li>RSA<\/li>\n \t<li>Diffie-Hellman<\/li>\n<\/ul>\n<a href=\"https:\/\/www.thesslstore.com\/blog\/cipher-suites-algorithms-security-settings\/\" rel=\"noopener\">We\u2019ve covered this at-length before<\/a>, but here\u2019s the abridged version: RSA uses public key encryption to exchange a pre-master secret and client random that are used to generate the session key.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f8ac949 elementor-widget elementor-widget-image\" data-id=\"f8ac949\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/04\/RSA-Key-Exchange-1024x233.png\" alt=\"\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e12b0e5 elementor-widget elementor-widget-text-editor\" data-id=\"e12b0e5\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tDiffie-Hellman is a method for both client and server to mutually arrive at the value that is the session key.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7b2eb2d elementor-widget elementor-widget-image\" data-id=\"7b2eb2d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/04\/Diffie-Hellman-Key-Share-1024x239.png\" alt=\"\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-772ffa1 elementor-widget elementor-widget-text-editor\" data-id=\"772ffa1\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tRSA key exchange has problems,\u00a0<a href=\"https:\/\/www.thesslstore.com\/blog\/bleichenbachers-cat-rsa-key-exchange\/\" rel=\"noopener\">namely Oracle padding attacks<\/a>. It\u2019s enough of an issue that last year\u00a0<a href=\"https:\/\/www.thesslstore.com\/blog\/you-should-be-using-ecc-for-your-ssl-tls-certificates\/\" rel=\"noopener\">we started advising organizations to stop using it<\/a>\u00a0in their implementations.\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5d9ae37 elementor-widget elementor-widget-text-editor\" data-id=\"5d9ae37\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tThe other knock against RSA is that it doesn\u2019t offer an ephemeral key mode. That\u2019s necessary for Perfect Forward Secrecy. Without forward secrecy, if someone saves the encrypted conversation and manages to compromise the private key, they can decrypt that session. This was especially relevant when Heartbleed was wreaking havoc as it allowed for the theft of private keys. Forward secrecy protects against that, which is why it\u2019s now mandated in TLS 1.3.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-50f046f elementor-widget elementor-widget-text-editor\" data-id=\"50f046f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tSo, RSA is out, along with all static (non Forward Secret) key exchanges while ephemeral Diffie-Hellman families are in.\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b360797 elementor-widget elementor-widget-text-editor\" data-id=\"b360797\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tHere\u2019s the other benefit, because RSA has been eliminated as a key exchange option, the client initiating the TLS handshake knows it\u2019s going to be a Diffie-Hellman family and can \u201cguess\u201d by sending the requisite randoms and inputs needed for key generation during its \u201chello.\u201d\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9fbbb60 elementor-widget elementor-widget-text-editor\" data-id=\"9fbbb60\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tThat effectively eliminates an entire round-trip on the handshake, reducing the time it takes and improving the overall performance of the website.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1001bd9 elementor-widget elementor-widget-text-editor\" data-id=\"1001bd9\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tThat leads perfectly into\u2026\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3dfed36 elementor-widget elementor-widget-heading\" data-id=\"3dfed36\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\"><h2>TLS 1.3 is faster because its handshake has been refined<\/h2><\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6800768 elementor-widget elementor-widget-text-editor\" data-id=\"6800768\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>As we just alluded to, at the outset of any HTTPS connection, the client and server perform\u00a0<a href=\"https:\/\/www.thesslstore.com\/blog\/explaining-ssl-handshake\/\" rel=\"noopener\">an SSL\/TLS handshake<\/a>. In TLS 1.2, it takes two round-trips from both sides to complete a handshake.<\/p><p>\u00a0<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2fe612f elementor-widget elementor-widget-image\" data-id=\"2fe612f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/04\/Two-Roundtrip-Handshake.png\" alt=\"\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"has_eae_slider elementor-section elementor-top-section elementor-element elementor-element-4f8b960 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"4f8b960\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"has_eae_slider elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-4107592\" data-id=\"4107592\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-e4ba5fc elementor-widget elementor-widget-text-editor\" data-id=\"e4ba5fc\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tIn TLS 1.3, that\u2019s been reduced to just one round-trip. That\u2019s because the number of negotiations taking places has now been cut down from four to two. Key exchanges, and by extension the digital signature scheme no longer require negotiation.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-91f5aee elementor-widget elementor-widget-text-editor\" data-id=\"91f5aee\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tNow, quickly, this is one round-trip under optimal circumstances, realistically it can sometimes take more because things don\u2019t always operate under the optimal circumstance. Either way, a shorter TLS handshake means connections to the site get made faster \u2013 with less latency.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c3753d6 elementor-widget elementor-widget-image\" data-id=\"c3753d6\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/04\/Single-Round-Trip-Handshake-1.png\" alt=\"\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-626ee20 elementor-widget elementor-widget-text-editor\" data-id=\"626ee20\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tNow, the difference is in milliseconds, which seems beyond negligible to a single person. But at scale it adds up. Enterprises are always looking for ways to improve network performance, which TLS 1.3 accomplishes.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b7b67df elementor-widget elementor-widget-text-editor\" data-id=\"b7b67df\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tAnother feature that will make TLS 1.3 faster is \u2018Zero Round Trip Time Resumption\u2019 (0-RTT). This feature allows for near-instantaneous session resumption for visitors who have recently visited your site. On mobile networks and at scale, this speed change is pretty noticeable.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"has_eae_slider elementor-section elementor-top-section elementor-element elementor-element-3319b93 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"3319b93\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"has_eae_slider elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-dab204e\" data-id=\"dab204e\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-e858043 elementor-widget elementor-widget-text-editor\" data-id=\"e858043\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tIn TLS 1.2, there are a couple ways to resume a connection: session IDs and session tickets. That\u2019s been combined into a pre-shared key in TLS 1.3. Much like the client and server generate session keys to use during the connection, once the connection has been established they can use a similar function to generate a \u201cresumption master key\u201d that facilitates 0-RTT.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1535fef elementor-widget elementor-widget-text-editor\" data-id=\"1535fef\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>When the client and server want to resume a session, the resumption master key is used to encrypt some application data for the server, which is sent along with the session ticket. The server validates it and the session resumes.<\/p>\n<p><br><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d0d3265 elementor-widget elementor-widget-heading\" data-id=\"d0d3265\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\"><h2>AEAD Bulk Encryption<\/h2><\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a40fb8c elementor-widget elementor-widget-text-editor\" data-id=\"a40fb8c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tBulk encryption is another way to refer to symmetric encryption. Traditionally there have been two ways to handle this:\n<ul>\n \t<li>Blocks<\/li>\n \t<li>Streams<\/li>\n<\/ul>\nBlock ciphers have all kinds of known issues, so they\u2019ve been done away with in TLS 1.3. You can still use a block cipher you just need to run it in stream mode. The big difference is a block mode cipher encrypts in fixed-length blocks, which need to be padded in some cases. That\u2019s not desirable.\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2fc8c4b elementor-widget elementor-widget-text-editor\" data-id=\"2fc8c4b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tStream ciphers, as the name so aptly applies, create streams of pseudo-random data of arbitrary length.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ddfe24a elementor-widget elementor-widget-text-editor\" data-id=\"ddfe24a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tA new wrinkle has been added in TLS 1.3 though: encryption and authentication have been combined into a single element. Message Authentication has always been a part of SSL\/TLS \u2013 otherwise it would be too easy to slip encrypted, malicious packets into the connection.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-42e06d6 elementor-widget elementor-widget-text-editor\" data-id=\"42e06d6\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\nBut, historically these two things have been decoupled. This new type of symmetric construction is called Authenticated Encryption with Additional Data (AEAD).\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f1e2401 elementor-widget elementor-widget-text-editor\" data-id=\"f1e2401\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tAEAD is a variant of Authenticated Encryption. There are generally a few accepted approaches to AE.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4f8e77c elementor-widget elementor-widget-heading\" data-id=\"4f8e77c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\"><h3>Encrypt-then-MAC (EtM)<\/h3><\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"has_eae_slider elementor-section elementor-top-section elementor-element elementor-element-84b4769 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"84b4769\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"has_eae_slider elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-49e9b8d\" data-id=\"49e9b8d\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-46557ea elementor-widget elementor-widget-text-editor\" data-id=\"46557ea\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tMAC stands for Message Authentication Code. In this approach, the plaintext is encrypted first, then a MAC is produced via a hash function that\u2019s based on that ciphertext, then the two are sent together. This is the strongest method provided the MAC is \u201cstrongly unforgeable,\u201d which means it has the appropriate level of entropy.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1605ded elementor-widget elementor-widget-image\" data-id=\"1605ded\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/EtM.png\" alt=\"\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5bbe0fb elementor-widget elementor-widget-heading\" data-id=\"5bbe0fb\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\"><h3>Encrypt-and-MAC (E&amp;M)<\/h3><\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-df83731 elementor-widget elementor-widget-text-editor\" data-id=\"df83731\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tEncrypt-<em>AND<\/em>-MAC derives a MAC from the plaintext (still a hash function), the plaintext is then encrypted WITHOUT the MAC and both the MAC and the ciphertext are sent along.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9acf4a3 elementor-widget elementor-widget-image\" data-id=\"9acf4a3\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/EM.png\" alt=\"\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e661316 elementor-widget elementor-widget-heading\" data-id=\"e661316\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\"><h3>MAC-then-Encrypt (MtE)<\/h3><\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"has_eae_slider elementor-section elementor-top-section elementor-element elementor-element-9b328c3 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"9b328c3\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"has_eae_slider elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-eea55d8\" data-id=\"eea55d8\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-1717083 elementor-widget elementor-widget-text-editor\" data-id=\"1717083\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tThe plaintext is used to generate the MAC, then BOTH the MAC and Plaintext are encrypted together and delivered.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-88166fc elementor-widget elementor-widget-image\" data-id=\"88166fc\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/01\/MtE.png\" alt=\"\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f4c8bee elementor-widget elementor-widget-heading\" data-id=\"f4c8bee\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\"><h3>MAC-and-Cheese (Mmm)<\/h3><\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-71996cd elementor-widget elementor-widget-text-editor\" data-id=\"71996cd\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<figure><img decoding=\"async\" style=\"width: 700px; height: 199px;\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/MC.png\" sizes=\"(max-width: 820px) 100vw, 820px\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/MC.png 820w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/MC-300x85.png 300w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/MC-768x218.png 768w\" alt=\"\" \/><\/figure>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ca02749 elementor-widget elementor-widget-heading\" data-id=\"ca02749\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\"><h2>Simplified Cipher Suites<\/h2><\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0542197 elementor-widget elementor-widget-text-editor\" data-id=\"0542197\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tNow that half of the negotiations have been eliminated from the handshake, the size of the cipher suites has shrunk, too.\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-599ae12 elementor-widget elementor-widget-text-editor\" data-id=\"599ae12\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tTLS 1.2 and its predecessors use Cipher Suites that include 4 ciphers. Here\u2019s an example:\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c9e8b72 elementor-widget elementor-widget-image\" data-id=\"c9e8b72\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/04\/TLS-1.2-Cipher-Suite.png\" alt=\"\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"has_eae_slider elementor-section elementor-top-section elementor-element elementor-element-00912c9 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"00912c9\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"has_eae_slider elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-86de92d\" data-id=\"86de92d\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-5beff3f elementor-widget elementor-widget-text-editor\" data-id=\"5beff3f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tIn TLS 1.3, cipher suites no longer include the key exchange and signature algorithms. Now it\u2019s just the bulk cipher and the hashing algorithm.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e131e72 elementor-widget elementor-widget-image\" data-id=\"e131e72\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/04\/TLS-1.3-cipher-suite.png\" alt=\"\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9890ca2 elementor-widget elementor-widget-text-editor\" data-id=\"9890ca2\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tOne of the biggest problems with TLS 1.2 was the acronym soup that drove the number of possible cipher combinations up into the dozens. That was nightmarish because there was too much choice \u2013 with little guidance on which cipher suites to support.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3c321a7 elementor-widget elementor-widget-text-editor\" data-id=\"3c321a7\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tThat has been whittled down substantially for TLS 1.3, to the point where there are now just five recommended cipher suites:\n<ul>\n \t<li>TLS_AES_256_GCM_SHA384<\/li>\n \t<li>TLS_CHACHA20_POLY1305_SHA256<\/li>\n \t<li>TLS_AES_128_GCM_SHA256<\/li>\n \t<li>TLS_AES_128_CCM_8_SHA256<\/li>\n \t<li>TLS_AES_128_CCM_SHA256<\/li>\n<\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-03bfd94 elementor-widget elementor-widget-heading\" data-id=\"03bfd94\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\"><h2>Who Supports TLS 1.3<\/h2><\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e31423b elementor-widget elementor-widget-text-editor\" data-id=\"e31423b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2><span style=\"color: rgb(51, 51, 51); font-size: 19px;\">When we answer this question, it really depends on whether you mean client-side or server-side. Most popular browsers already support it from the client side.<\/span><br><\/h2>\n<ul>\n<li>Google Chrome \u2013 Version 67+<\/li>\n<li>Mozilla Firefox \u2013 Version 61+<\/li>\n<li>Apple \u2013 Mac OS 10.3 &amp; iOS 11<\/li>\n<\/ul>\n<p>Microsoft has been a bit slower updating its operating system and browsers. Chromium-based Edge browsers support it, but the rollout has been slower in other areas.<\/p>\n<p>Here\u2019s a chart that shows client-side support:<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"has_eae_slider elementor-section elementor-top-section elementor-element elementor-element-d7d44c6 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"d7d44c6\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"has_eae_slider elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-0cd22dc\" data-id=\"0cd22dc\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-a7d2db8 elementor-widget elementor-widget-image\" data-id=\"a7d2db8\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/Support-1-1024x238.png\" alt=\"\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-824041a elementor-widget elementor-widget-heading\" data-id=\"824041a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\"><h2>How do I upgrade to TLS 1.3 on my server?<\/h2><\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ab9016b elementor-widget elementor-widget-text-editor\" data-id=\"ab9016b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tUpgrading to TLS 1.3 is really as straightforward as updating the software library you\u2019re using. You simply need to update your SSL\/TLS library to one of these versions:\n<ul>\n \t<li>OpenSSL 1.1.1<\/li>\n \t<li>GnuTLS 3.5.x<\/li>\n \t<li>Google\u2019s Boring SSL (current)<\/li>\n \t<li>Facebook\u2019s Fizz (current)<\/li>\n<\/ul>\nAdditionally a number of hosting and service providers like Cloudflare, Akamai, Google and Facebook all support TLS 1.3 connections, too.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0dfa7c4 elementor-widget elementor-widget-text-editor\" data-id=\"0dfa7c4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\nThere may some configuration required, which will vary by server, but the bulk of the heavy lifting will come when you upgrade your software library to a version that support TLS 1.3.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a5fb860 elementor-widget elementor-widget-heading\" data-id=\"a5fb860\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\"><h2>Troubleshooting some common TLS 1.3 errors<\/h2><\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0d80474 elementor-widget elementor-widget-text-editor\" data-id=\"0d80474\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tThere are a couple of problems you may run into when implementing TLS 1.3. Neither of them are particularly worrisome, but it\u2019s worth pointing them out anyway.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-467197d elementor-widget elementor-widget-heading\" data-id=\"467197d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\"><h3>Browser Errors<\/h3><\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8688339 elementor-widget elementor-widget-text-editor\" data-id=\"8688339\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tGoogle Chrome users attempting to reach your website might get an error that says:\n<pre>ERR_SSL_VERSION_INTERFERENCE<\/pre>\nThis indicates that there is no mutually agreeable TLS version available for the client and server to use for their connection. This can happen for a number of reasons, the most prevalent being that the server only supports TLS 1.3 and the client doesn\u2019t.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"has_eae_slider elementor-section elementor-top-section elementor-element elementor-element-46f408c elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"46f408c\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"has_eae_slider elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-9605c79\" data-id=\"9605c79\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-36df416 elementor-widget elementor-widget-image\" data-id=\"36df416\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/11\/bigstock-Computer-Screen-With-Warning-A-237826066-e1542224215167-300x300.png\" alt=\"\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3ad98cb elementor-widget elementor-widget-text-editor\" data-id=\"3ad98cb\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tThis is why, at least for a few more years, leaving legacy support for TLS 1.2 is important. That\u2019s already the reason some servers still support TLS 1.1 and TLS 1.0: older clients can\u2019t connect to with the new protocols.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a1e02c6 elementor-widget elementor-widget-text-editor\" data-id=\"a1e02c6\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tBut we\u2019ve reached the point where interoperability is beginning to hurt security too much, which is why\u00a0<a href=\"https:\/\/www.thesslstore.com\/blog\/apple-microsoft-google-disable-tls-1-0-tls-1-1\/\" rel=\"noopener\">both of those protocol versions will be completely deprecated come January 2020<\/a>.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d36a869 elementor-widget elementor-widget-heading\" data-id=\"d36a869\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\"><h3>Running old versions of TLS 1.3<\/h3><\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0a8e0af elementor-widget elementor-widget-text-editor\" data-id=\"0a8e0af\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tOne of the other problems you may run into was born out of the draft process and then numerous versions that were penned before the protocol was finalized.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-76aaf75 elementor-widget elementor-widget-text-editor\" data-id=\"76aaf75\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tAs we discussed, the way these drafts were vetted was live testing. Various browsers and platforms implemented early versions of 1.3 to see how it fared. That means there are a bunch of different versions of TLS 1.3 out there \u2013 and not all of them play nicely together.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-aeadfba elementor-widget elementor-widget-text-editor\" data-id=\"aeadfba\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tMake sure you and your customers are using the latest versions of your respective browsers, OSs and software libraries. Trying to connect with an outmoded draft version of TLS 1.3 can cause errors and problems.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9c63c48 elementor-widget elementor-widget-heading\" data-id=\"9c63c48\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\"><h2>Start using TLS 1.3<\/h2><\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d93d19d elementor-widget elementor-widget-image\" data-id=\"d93d19d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/11\/TLS-1.3-300x283.png\" alt=\"\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-938dc4b elementor-widget elementor-widget-text-editor\" data-id=\"938dc4b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tTLS 1.3 has been official for almost a year now, yet it hasn\u2019t been as widely adopted as some hoped. Given the rate of adoption for TLS 1.2, which took ten years and still hasn\u2019t reached its intended goal, it may be foolish to hope that the internet will make the move quickly.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a381fe0 elementor-widget elementor-widget-text-editor\" data-id=\"a381fe0\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\nBut,\u00a0<a href=\"https:\/\/www.thesslstore.com\/blog\/google-chrome-68-https-mandatory\/\" rel=\"noopener\">with HTTPS and SSL\/TLS now mandatory<\/a>\u00a0and the internet at large more acutely aware of cybersecurity and the need for it \u2013 maybe we\u2019ll see it become the norm in the next 2-3 years.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a2f0032 elementor-widget elementor-widget-text-editor\" data-id=\"a2f0032\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tThat all starts with you. The benefits are clear. It\u2019s more secure. It\u2019s lighter and faster. And it shows your organization is forward-thinking when it comes to securing itself and its customers.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>TLS 1.3 has myriad improvements over its predecessors, including a new handshake and revamped cipher suites. Before anyone points out that the IETF published TLS 1.3 as RFC 8446 almost a year ago \u2013 we know.\u00a0We covered that. But we realized we hadn\u2019t done an in-depth explainer of the new protocol version yet, and given<\/p>\n","protected":false},"author":603,"featured_media":8302,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[195],"tags":[93],"ppma_author":[3312],"class_list":["post-2357","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-iot","tag-internet-of-things"],"authors":[{"term_id":3312,"user_id":603,"is_guest":0,"slug":"patrik-nohe","display_name":"Patrik Nohe","avatar_url":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=mm&r=g","user_url":"","last_name":"Nohe","first_name":"Patrik","job_title":"","description":"Patrick Nohe, Content Manager for The SSL Store&trade; and &nbsp;Hashed Out&#039;s Editor-in-Chief, started his career as a beat reporter and columnist for the Miami Herald before moving into the cybersecurity industry a few years ago."}],"_links":{"self":[{"href":"https:\/\/www.experfy.com\/blog\/wp-json\/wp\/v2\/posts\/2357","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.experfy.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.experfy.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.experfy.com\/blog\/wp-json\/wp\/v2\/users\/603"}],"replies":[{"embeddable":true,"href":"https:\/\/www.experfy.com\/blog\/wp-json\/wp\/v2\/comments?post=2357"}],"version-history":[{"count":6,"href":"https:\/\/www.experfy.com\/blog\/wp-json\/wp\/v2\/posts\/2357\/revisions"}],"predecessor-version":[{"id":35090,"href":"https:\/\/www.experfy.com\/blog\/wp-json\/wp\/v2\/posts\/2357\/revisions\/35090"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.experfy.com\/blog\/wp-json\/wp\/v2\/media\/8302"}],"wp:attachment":[{"href":"https:\/\/www.experfy.com\/blog\/wp-json\/wp\/v2\/media?parent=2357"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.experfy.com\/blog\/wp-json\/wp\/v2\/categories?post=2357"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.experfy.com\/blog\/wp-json\/wp\/v2\/tags?post=2357"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.experfy.com\/blog\/wp-json\/wp\/v2\/ppma_author?post=2357"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}