What Is SSL Encryption? A Guide to SSL Encryption

We’ve already published guides explaining what the SSL protocol is and how you can use it to secure a website. Now, it’s time to answer what SSL encryption is clearly and concisely.

What Is SSL Encryption?

SSL encryption refers to the use of public key cryptography and an SSL/TLS certificate to secure website data in transit. Ever see the secure padlock in Firefox’s web address bar and the “connection is secure” message in Chrome? SSL encryption puts them there.

In a nutshell, SSL encryption enables a server to prove its digital identity to the connecting web client (this process is known as “authentication”) and secures the otherwise plaintext data that is exchanged between the two parties. Some of this information is then used to establish a symmetrically encrypted connection for the rest of the session, as it’s faster and more efficient at scale.

Technically, “SSL” (meaning the secure sockets layer) is an obsolete security protocol. On the internet, it’s essentially been replaced by TLS, which stands for the “transport layer security protocol” and is a significantly faster and more efficient security protocol than its predecessor. However, the term “SSL” has stuck, and most people still call it SSL even if it’s technically TLS now.

How Strong Is SSL Encryption?

When implemented correctly, SSL/TLS encryption is essentially unbreakable with regard to today’s technology. Technically speaking, SSL encryption typically offers ~128-256 bits of security.

To break that level of security with brute force, you would need to try 340,282,366,920,938,463,463,374,607,431,768,211,456 different possible keys for a 128-bit key. Even if you somehow made a supercomputer that could try 1 quintillion keys per second (10¹⁸/s), meaning “a billion computers, each trying a billion keys per second,” it would take you 10.8 trillion years to break the encryption.

It’s expected that future quantum computers may be able to break current SSL encryption. But not to worry — the industry is already working on shifting to quantum-proof encryption algorithms.

The 5 Key Elements of SSL Encryption

When a user connects to your website, their browser seeks to establish a secure, encrypted connection with your site’s web server. This involves using all of the following:

1. The SSL (TLS) security protocol,
2. An SSL/TLS certificate for the website in question (NOTE: The certificate must be issued by a publicly trusted certification authority [CA] when used on public-facing websites)
3. A public-private key pair (which is tied to the aforementioned server certificate,
4. A list of cryptographic ciphers (i.e., algorithms), and
5. Communication exchanges between the two endpoints (in a process known as an SSL or TLS handshake).

How SSL Encryption Works

Now that we can define what SSL encryption is, it’s time to explore how it works. This essentially means talking about the SSL/TLS handshake and its role in establishing encrypted website connections.

• A user’s browser begins the SSL/TLS handshake by sending a “client hello” message to the server.
• The server responds by sending its server certificate and its associated public key.
• The browser verifies the certificate’s validity by checking the trusted root CA that the certificate chains back to.
• The server and client exchange data relating to their strongest supported algorithms to determine how they will communicate.
• The client uses the server’s public key to encrypt private (secret) session key data.
• The server uses the corresponding private key to decrypt the client’s message.
• Both parties now use the key to communicate securely using that symmetrically encrypted connection for the rest of the session.

Here’s a quick overview illustration that shows how this process works:

That’s it in a nutshell! Now that the encrypted session is in effect, any data communicated between the client and server is sent via a secure channel. This means that anyone who manages to intercept the data won’t be able to read it because they won’t have access to the private decryption key.

TL;DR: Quick-Hit SSL Encryption Definitions and Key Takeaways

• Simple SSL encryption definition: “SSL encryption” is a set of rules that enable secure communications for websites. This allows the “HTTPS” to display at the front of your favorite website’s URL.
• Technical SSL encryption definition: SSL encryption refers to a security protocol that enables authenticated data to be transmitted securely between a website and a connecting user.
• What SSL encryption does: Uses the SSL protocol + asymmetric cryptography + a public-private key pair to negotiate a secure, encrypted connection.
• How SSL encryption works: This approach works by using asymmetric encryption to convey digital identity, key, and cipher-related data that is then used to establish an encrypted connection.