Exact Protocol Level Differences Between Ssl And Tls

SSLv2 and SSLv3 are completely different (and both are now considered insecure). SSLv3 and TLSv1.0 are very similar, but have a few differences.

You could consider TLSv1.0 as SSLv3.1 (in fact that's what happens within the records exchanged). It's just easier to compare the TLSv1.0 with TLSv1.1 and TLSv1.2 because they've all been edited within IETF and follow more or less the same structure. SSLv3 being edited by a different institution (Netscape), it makes it a bit more difficult to spot the differences.

Here are a few differences, but I doubt I can list them all:

In the ClientHello message (first message sent by the client, to initiate the handshake), the version is {3,0} for SSLv3, {3,1} for TLSv1.0 and {3,2} for TLSv1.1.
The ClientKeyExchange differs.
The MAC/HMAC differs (TLS uses HMAC whereas SSL uses an earlier version of HMAC).
The key derivation differs.
The client application data can be sent straight after sending the SSL/TLS Finished message in SSLv3. In TLSv1, it must wait for the server's Finished message.
The list of cipher suites differ (and some of them have been renamed from SSL_* to TLS_*, keeping the same id number).
There are also differences regarding the new re-negotiation extension.
I would strongly recommend Eric Rescorla's book - SSL and TLS: Designing and Building Secure Systems, Addison-Wesley, 2001 ISBN 0-201-61598-3, if you really want more details. I've learnt about some of the points mentioned above from this book. The author occasionally mentions the differences between SSLv3 and TLS (v1.0 only at the time the book was written) when explaining some of the SSL/TLS message, but you do need the background explanation about these messages to have a chance to understand (and it's not appropriate to copy/paste from this book here).

Original source: http://serverfault.com/questions/178561/what-are-the-exact-protocol-level-differences-between-ssl-and-tls/179139#179139

Unless otherwise stated, the content of this page is licensed under Creative Commons Attribution-ShareAlike 3.0 License