1

taken from http://searchsecurity.techtarget.com/answer/How-does-SSL-sit-between-the-network-layer-and-application-layer

The SSL protocol is quite unusual, as it doesn't just operate at one layer. SSL is neither a network layer protocol nor an application layer protocol. It is one that "sits" between both layers.

If this is correct then can we say that https works on layer6 and below.

Improve this question
2
  • 1
    SSL, much like the rest of the TCP/IP stack and almost all typical systems, do not align properly with the classical OSI stack model. So this question doesnt really make too much sense.
    – AviD ♦
    Dec 19, 2012 at 9:20
  • TLS stands for Transport Layer Security. In the OSI model this layer is responsible for end-to-end connections and reliability and is between application and network layers.
    – freb
    May 4, 2015 at 3:40

2 Answers 2

Reset to default
2

I guess it depends on what model you're looking at.

Using the OSI model, it is at layer 5, the Session layer. This is because it is "session encryption" and not data encryption. Data encryption would be at layer 6, the presentation layer.

Using the TCP/IP model, it is at layer 4, the Application layer.

It seems like they're talking about the OSI model because there isn't a network layer in the TCP/IP model, they only have the Application, Transport, Internet, and Link. If they are talking about the OSI model they are entirely correct...

In an extremely abridged format:

  • It's not the application layer because SSL/TLS isn't process to process.
  • It's not the presentation layer because SSL/TLS isn't a data translator.
  • SSL/TLS is the session layer.
  • It's not the transport layer because SSL/TLS has to do with a lot more than typical end-to-end communication.
  • It's not the networking layer because SSL/TLS has to do with a lot more than just reaching the destination.
Improve this answer
2
  • How about ssl handshake,doesnt it takes place at transport layer?
    – kevin
    Dec 19, 2012 at 3:59
  • @kevin I don't believe it does. The SSL/TLS handshake is setting up the session encryption, and uses the transport layer for sure. However, just because it's not encrypted yet doesn't mean it's not the session layer.
    – JZeolla
    Dec 19, 2012 at 14:25
4

The OSI model which describes networks as a set of rigid layers has never been a good match for TCP/IP networks. It is a remnant of an old terminology war between the world of elegant, abstract, intellectual constructions, and the world of the Internet, aka the network which exists and works.

SSL is built on top of a medium which, in the OSI model, would be "transport" (layer 4): SSL uses a bidirectional channel for untyped bytes; SSL needs that this channel, under non-hostile condition, is reliable (bytes are unaltered and eventually show up at the receiving end in the right order). On the other hand, SSL provides a transport medium (there again, a bidirectional channel for untyped bytes, this times with confidentiality and guaranteed integrity). So, in OSI model terminology, SSL sits between layer 4 and layer 4. Yes, not between two "distinct" layers, but right "in the middle" of a layer.

All of this just shows that the OSI model does not apply to the real world. Why this model is universally taught in all network courses is beyond me.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.