If I use TLS as the protocol to send SSL encrypted packages through a SSH tunnel would this connection be safer than using any of the tools alone?

** EDIT **
Suppose I would TLS(SSL(SSH(data))) (thanks forest), a MySQL database connection for instance, would it be safer than just SSH(data) or TLS(data)? This question popped up at the uni and we discussed it for some time with mixed results.

PS.: If this sounds like a beginner question it's because it is.

  • 1
    Are you asking if TLS(SSL(SSH(data))) is more secure than TLS(data) alone? – forest Aug 31 '18 at 23:21
  • Yes (but I'm not sure of what the arrows mean). – Rafael Corrêa Aug 31 '18 at 23:22
  • The arrow means layering. I've edited my comment to hopefully make more sense. Unfortunately, as it is this question is probably too broad. You have to define exactly from what you need to protect. I'd also like to point out that SSL (the old protocol, as opposed to TLS) is broken. – forest Aug 31 '18 at 23:24
  • Any time you ask "would this be safe(r)?" you have to answer the question "against what?". In more technical terms, you need to define your threat model before you can determine how well any given response (such as, in this case, layered encryption) protects against that threat model. For a real-world, extreme example, it does you no good against burglary to install a 50 cm thick solid-steel door to your home if you always leave the first-floor windows wide open; a thief would just climb through a window instead. In other situations, that new door might actually help. – a CVn Sep 1 '18 at 15:20

Layering multiple network encryption protocols does not particularly improve the confidentiality or integrity of the payload data you are transmitting. While SSL is broken (the SSL2 and SSL3 protocols), TLS is considered relatively strong, particularly TLS1.2 and the upcoming TLS1.3. The same is true with SSH2 (virtually all modern SSH connections use SSH2), which also uses strong and secure algorithms. Layering multiple protocols increases the risk that one of the protocol implementations will be vulnerable to a fatal attack, making it potentially worse to layer them.

Fundamentally, all these different protocols are implementations of the exact same (or equivalent) algorithms. Both TLS and SSH use DHE or ECDHE to securely exchange a secret key, they both support strong ciphers like AES to encrypt your data with said secret key, and they both use strong techniques such as HMAC to protect the integrity of the data. They only differ in what they are optimized for. For example SSH has features that reduce latency for sending keystrokes, whereas TLS has extensive features to support a trusted PKI (Public Key Infrastructure).

Instead, what you should do is pick a single protocol that is well suited for your needs and use it. For something like a MySQL database connection, it would probably be best to use TLS. It is optimized for these kinds of connections whereas SSH has different optimizations that may not be necessary. In terms of the actual encryption algorithms being used, they are all equally strong.


In general I would say No.

For almost all cryptographic purposes on the internet, TLS 1.2 by itself is more than good enough. (if someone could demonstrate that it wasn't, then it would be considered broken and it would be retired). Your question is sortof similar to asking "Will I cross the street faster if I push the crosswalk button three times instead of once?"

Moreover, I suspect that if I can break your TLS (for example by hacking into your server and stealing the server's private key) then I can probably do the same for whatever other protocols you're layering.

Unless you have a specific reason why you believe TLS to be insecure in your environment, or you have some exceptionally high national military type security needs (and have hired a team of crack cryptographers to engineer something better than TLS, the state of the art in cryptography), then you won't get any practical benefit out of layering. Even then, you'd might as well just replace TLS with a single stronger protocol rather than layering.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.