1
$\begingroup$

I'm studying public key cryptography, but still, there's something that I'm not able to understand. I know that, in order to communicate with the server the client must use the public key of the server, but what happens when the server needs to send a message to the client?

It can't use its private key since anyone would be able to decrypt the message, so my question is: ​ Does the client have a public key?

$\endgroup$
  • $\begingroup$ week 5 and 6 of Stanford Cryptography course at coursera.com will help you a lot in understanding the concepts and best practices for Public key Cryptography. coursera.org/learn/crypto/home/welcome $\endgroup$ – khan Apr 24 '17 at 20:05
3
$\begingroup$

... what happens when the server needs to send a message to the client?

The server uses the symmetric key that the client sent to the server.

Does the client have a public key?"

Sometimes.

$\endgroup$
2
$\begingroup$

It can't use its private key since anyone would be able to decrypt the message, so my question is: ​ Does the client have a public key?

Please note that the public / private key is (by default simple SSL) used only to authenticate the server, client can stay anonymous. The server's public key is used only to safely exchange (encrypt/decrypt) random session keys which are used for symmetric encryption (see https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange + server can sign the generated session key with its public key to ensure it's identity )

These symmetric keys are used to encrypt communication between the server and client (both way), so the client doesn't need any public key (or certificate) to establish secure communication.

The client may have its own keypair (and certificate), they are used to authenticate the client, not decrypt the messages.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.