CLIENT - The client initiates the communication to the server over a secure port ex. 443, says Hello, and gives the server its SSL version, cipher settings and other information to the server telling it - "Hey you can talk to me using the information I just provided."
SERVER - Now the server replies to this Hello from client by saying Hello and gives the client its SSL version, cipher settings and other information to the client telling it - "Hey you can talk to me using the information I just provided." It also provides the client with its public key.
It’s like 2 couples sharing each other’s private phones numbers to talk privately.
Note If the client is requesting any server resources that require client authentication the server requests the client digital cert to be sent as well.
CLIENT - The client now uses all the data given by the server (data obtained during this handshake) creates a pre master secret key for the session and encrypts it with the server public key that it was given during step2. It then sends this pre master key to the server. (Only client has the pre master key for now.)
SERVER - The server decrypts this pre master key using its private key.
Note at this point after step 4 both the client and server has the pre master key.
CLIENT & SERVER - From this point on both the parties perform series of steps, starting from the same pre master key - generate a master secret password. Both client and server use this master key and generate symmetric keys which are used to encrypt and decrypt information during SSL session.
CLIENT - Client informs the server from this point on all future messages from it are going to be encrypted using the session key and then sends a separate encrypted message telling the server that client portion on SSL handshake has been completed.
SERVER - Pretty much does the same as above. Informs the client that from this point on all future messages from it are going to be encrypted using the session key and then sends a separate encrypted message telling the client that server portion on SSL handshake is now complete.
SSL handshake is now done and SSL session has begun. Whatever happens between the client and server is now encrypted and either parties use the symmetric keys to encrypt and decrypt.
Note - Symmetric encryption has begun after the last step. In this kind of encryption both the parties use the shared password (symmetric key) to encrypt and decrypt messages. But notice that to get to this point PKI (public and private key) infrastructure was in play. This is faster than situations where both the parties use public and private key all the time and would be taxing on the client and server.
Also keep in mind that if A encrypts a piece of information using B's Public key the only B who has the private key can decrypt it.
If A encrypts a piece of information using A's Private key then anyone who trusts A's public key can decrypt it. Successfully decrypting the information proves that it was send by A and no one else.
Head spinner but this is one of the most important topic and I tend to fall back on this explanation time to time.
No comments:
Post a Comment