Hybrid Symmetric and Asymmetric Encryption

Question

Just looking for a bit of an explanation on the concept of hybrid symmetric and asymmetric encryption.

My understanding:

1. Client requests public key from https://site1.com
2. The client receives the public key and then generates a symmetric key and then encrypts the newly generated key with the public key provided in by site1.com. Sends to site1.com
3. Site1.com using its private key decrypts the message to find the client's symmetric key

Is my understanding correct?

The idea with the hybrid is to use symmetric encryption to speed up communication. The website site1.com now has the client's symmetric key.

Further questions about what happens next:

Does site1.com now use that key to encrypt communication between it and the client? If so, what has told site1 to do that? Was it simply finding a key encrypted inside of a message?

Answer 1

A hybrid cryptosystem consists of both an asymmetric algorithm for key establishment and a symmetric cipher. You are correct in that you establish a symmetric key, and yes, that can be done by encrypting it with a public key. Note that that public key needs to be trusted. Otherwise an adversary could supplant it with his own public key.

After the symmetric key is established you can use it to encrypt messages. Nowadays you'd want to use an authenticated cipher for that. Only the sender and receiver have the symmetric key, so they can now efficiently exchange messages of any size. You could use the key just to encrypt a single message. In that case commonly the wrapped (encrypted) symmetric key, and the message encrypted with that symmetric key will be send together.

Generally you don't just send messages from one site to the other without warning. You use a protocol such as TLS, which commonly utilizes a hybrid encryption scheme where Diffie-Hellman is used to establish the keys. Previously RSA encryption was often used to establish a secret, which was then used to derive the session keys. The protocol defines how the messages need to be handled.

TLS is used for secure HTTPS connections in the browser. It is the first protocol to get executed when you connect to port 443 of a web server. So in this case the port indicates the protocol, and the protocol defines how the messages are handled. So there are no unexpected messages (and the protocol will disconnect if out-of-band messages are received).

Answer 2

Client receives public key and then generates a symmetric key and then encrypts the newly generated key with the public key provided in by site1.com. Sends to site1.com

Not really. The client generates a pre-master secret that is encrypted by the public key of the server. Now the server decrypts it and derives multiples keys, one of these is the shared key, the client does the same key derivation too. This is the normal procedure on RSA as key exchange. In Diffie-Hellman or ECC the pre-master key is just the public value of the user.

Site1.com using its private key decrypts the message to find the client's symetric key

The symmetric key doesn't exist yet. The server will decrypt the pre-master secret then derive the symmetric key. Now both endpoints have a symmetric key to encipher information. The goal of hybrid cryptography is to exchange a secret used to derive a symmetric key