0
$\begingroup$

There is a lot of confusing information out there regarding the role of digital certificates and the use of Ephimeral Diffie Hellman in how TLS 1.3 operates.

Would it be correct to state that the the digital certificate signed by the CA is only used by the client to verify that it is connected to the correct server ? The asymmetric keys are not used for anything else ?

Once the client establishes the authenticity of the server, then Ephemeral Diffie Hellman takes over and the client and the server arrive at a ephemeral session key ?

When the client and the server exchange the public values to arrive at a ephemeral session key, do they encrypt the public values with asymmetric encryption or are they sent in plain text ?

$\endgroup$

1 Answer 1

2
$\begingroup$

The asymmetric keys are not used for anything else ?

It is also used to verify that the initial negotiation was not tampered with; for example, a Man-in-the-Middle did not replace the server's DH key shares with his own.

Once the client establishes the authenticity of the server, then Ephemeral Diffie Hellman takes over and the client and the server arrive at a ephemeral session key ?

Actually, the order is the other way; the DH is done first (thus generating privacy), and then the two sides authenticate (and verify that, again, the negotiation wasn't tampered with).

When the client and the server exchange the public values to arrive at a ephemeral session key, do they encrypt the public values with asymmetric encryption or are they sent in plain text ?

The DH key exchange is done in the clear. For one, it's done first (and there is no preexisting keys to encrypt anything yet. For another, doing DH in the clear is perfectly safe against passive attackers (and active attackers will be detected later on, as a part of the signature verification).

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.