Is there a difference between SSLv3 and TLS1.0?

Question

Is there a difference between SSLv3 and TLSv1? How does IIS6.0 control what type of security is used for a website enabled with HTTPS?

MS says that there is a hierarchy in which the security and encryption level is negotiated before connection is established. What is this hierarchy?

Is SSLv3 available in IIS6.0 by default on Windows Server 2003?

Answer 1

SSLv3 and TLSv1 are not the same, however TLSv1 is based on SSLv3.

This is a protocol which is backward compatible, and gives a way to determine which version to use according to the "handshake" that takes place between the client and the server.

Read more here (this helped me understand it better): http://en.wikipedia.org/wiki/Secure_Sockets_Layer

Answer 2

Thanks. but what is the difference/advantage of TLSv1 over SSLv3 then? What is the hierarchy when the protocol is determined during the handshake - will the web server (IIS6.0) prefer TLSv1 over SSLv3? Can this be configured?