When I learned TLS does not allow a connection to be created until it is has finished a secure handshake, i figured that would make it better for preventing DoS attacks.

However, all I seem to find on the topic is stuff about TLS Renegotiation DoS attacks.

Are either of these technologies more robust, specificially wth regards to DoS attacks?

Thank you.

  • 2
    I think you meant TLS instead of TSL. If you indeed meant TSL, which is an acronym I am unfamiliar with, please feel free to roll back my edit. – user10211 Jun 10 '13 at 9:56
  • Thank you, @Terry Chia. I would +1 your comment if I could! – Jordan Morris Jun 10 '13 at 9:59
  • 2
    1) TLS is simply SSL 3.1+ 2) Client initiated renegotiation is disabled by default in most servers. I wouldn't expect a big DOS difference. I recommend using the newest supporting version, and falling back to older versions including SSL 3.0 if necessary. – CodesInChaos Jun 10 '13 at 11:22
  • TLS renegotiation is not a DoS attack. Its goal is to hijack the connection, no to tear it down or prevent it to be completed. – bortzmeyer Jun 15 '13 at 21:19

TLS is the "standard" name of SSL. SSL is, initially, a protocol developed by people at Netscape (the vendor of the then-leading Web browser, back in 1995). When SSL was made an open standard, specified as RFC 2246, a new name was given to it, partly to avoid legal issues, partly to convey the message that SSL can be applied to any bidirectional stream of bytes, not just TCP sockets; the new name is TLS. Internally, when the client and the server talk to each other and tell them which protocol version they use, they announce SSL 3.0 as "3.0" and TLS 1.0 as "3.1". For all practical purposes, SSL and TLS are two names for the same protocol, which can have several versions; I often write "SSL/TLS" to designate them.

For all security characteristics, TLS 1.0 can be considered equivalent to SSL 3.0; differences are minimal and more relate to alignment on existing standards than functional changes (e.g. the MAC algorithm in SSL 3.0 is a "sort of" HMAC, while the MAC algorithm in TLS 1.0 is HMAC, exact down to the last bit). Ulterior versions of TLS bring some improvements for security.

However, none of the SSL/TLS versions is better or worse than the others with regards to DoS attacks. The main vulnerability of SSL/TLS, in that respect, is that the initial handshake entails some relatively expensive computations on the server side, and a fake client can force the server to spend a lot of CPU power on making handshake without needing to invest much effort in the process (the client just has to send some random junk of approximately the right size as the ClientKeyExchange message, and the server will spend some time trying to decrypt it). A good PC will handle a few hundreds or at most one or two thousands of SSL handshakes per seconds, so DoSing an unprotected SSL server is not very hard. Mitigation measures are along the lines of refusing too many TCP connection attempts per second from a given IP address.


I would say both are equally vulnerable, since the behavior for different DoS attacks will be the same, either SYN Flood or a fully established connection (3-way handshake completed) doesn't will try a SSL/TLS negotiation, in the case the attacker does issue a SSL/TLS negotiation it's trivial to assemble a valid request/response to both protocols.


TLS is the next version of SSL. SSL goes up to version 3, and then it starts with TLS v1.

TLS is therefore unilaterally better than SSL. It contains all of SSL's good points, plus additional improvements added over time.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.