17

As a Web Developer I recently realised my understanding of HTTPS is poor and am currently endeavouring to better understand it.

After some initial reading I'm left a bit puzzled as to why initially asymmetric private/public key cryptography is used but only as a means to exchange a symmetric key.

Why do the client and server not, once the client has verified the server's certificate and has its public key, just exchange data encrypted with each other's public key?

I realise this is probably a naive question!

Pseudonymous
  • 279
  • 1
  • 6
  • 1
    Because direct use of an asymmetric cypher is too slow. – Joshua Jan 03 '15 at 00:00
  • 1
    Performance and security. The details are here: http://security.stackexchange.com/questions/33434/rsa-maximum-bytes-to-encrypt-comparison-to-aes-in-terms-of-security – JCx Jan 03 '15 at 18:16

0 Answers0