0

I'm reading up on web security. And I'm a bit lost at a few places.

First stage is the Hello phase.

  1. The client sends a message to the server telling the server, I will use these versions of SSL, and cipher suites. First question is, how exactly do the parts of a cipher suite work?

Second stage is Certificate Exchange

  1. Certficate exchange.

Third stage is Key Exchange

  1. Key Exchange - The encryption of the actual message data exchanged by client and server will be done using either a symmetric algorithm or asymmetric. Second question, How exactly do these keys work to be applied to encrypting/decrypting messages. What is the difference between public and private keys, and how is this different than using just the symmetric key for symmetric algorithms?
christopher clark
  • 137
  • 5
  • 2
    Your questions are valid, good questions, but almost certainly too broad for the format of an answer here unfortunately. Entire books are written on the topic of each of your questions. :) – Gabor Lengyel Oct 24 '16 at 21:59
  • Yes, too many questions in one post. – d1str0 Oct 24 '16 at 22:40

1 Answers1

1

You ask numerous questions, so I'll try to address a few of them.

First, the question posed by the title, "What exactly are the keys doing in a Certificate?"
They're doing nothing, because they are not there. The key-related stuff in an X.509 Certificate is just a hash of the public key to which the Certificate applies.

"how exactly do the parts of a cipher suite work?"
The specified symmetric cipher will be used, with randomly generated per-session keys, to encrypt the data streams. The specified asymmetric or Public Key cipher will be used to establish the session, including exchanging keys to be used for the symmetric cipher. Both ends of the connection have to agree to use the same cipher suite.

"How exactly do these keys work to be applied to encrypting/decrypting messages"
The exchanged keys, which have been randomly generated for this session only, are used with the symmetric cipher to encrypt and decrypt the data streams.

"What is the difference between public and private keys"
From just the Public key it is not possible (or, it is computationally infeasible) to derive the Private key. Thus, you can make your Public key, well, public. Details of just how Private/Public key pairs are generated is specific to each Public Key algorithm.

"how is this different than using just the symmetric key for symmetric algorithms?"
Public Key algorithms are generally slower than symmetric algorithms, but they win in the key-distribution stakes: To exchange symmetrically-encrypted messages pairwise between N parties, where each message is readable only by its intended recipient, requires O(N^2) keys - each party needs to distribute different keys to each of the other (N-1) parties. To achieve the same result using an asymmetric cipher requires just N Private/Public key pairs - each party publishes its own Public key, and keeps its own Private key secret.

mlp
  • 546
  • 4
  • 8