2
$\begingroup$

How I think HTTPS works when sending data from server to client:

-Server has 1 public, 1 private key.

-Client has access to the server's public key and not it's private key.

-Client has no keys of its own.

-Server uses its public key to encrypt data and sends it to the client. Client then uses the same public key to decrypt the message.

Is this how it works when the server sends data to the client? How does a server encrypt the data it sends to its clients? Are there a set of public and private keys for both devices?

I understand how the data sent from the client to server would be secure. Client encrypts data with the public key which then can only be decrypted with the private key and nothing else. But from my understanding, the client has no private and public keys of its own, so how does HTTPS work again?

|improve this question
$\endgroup$
  • $\begingroup$ Do a search for "SSL inspection" and relevant corporate appliances/products to see how to do it pretty easily in certain cases... $\endgroup$ – Paul Uszak Jul 25 at 20:27
  • $\begingroup$ @PaulUszak That isn't helpful. OP has a fundamental misunderstanding as to the nature of hybrid cryptosystems. He's asking why a certain attack doesn't work, not asking how to get around a specific protocol in a much more complicated infrastructure (PKI). $\endgroup$ – forest Jul 27 at 6:29
2
$\begingroup$

I'm assuming you're talking about RSA. The more common DH algorithm uses ephemeral public and private keys generated by both the server and the client, although that's not relevant to this answer. The public and private keys are not used to exchange traffic. Instead, they're used to exchange a symmetric key which is used to encrypt data going both directions. This is what's called a hybrid cryptosystem.

Now, TLS in particular is a little more complicated than that. It uses two symmetric keys, one for each direction, in order to protect from certain kinds of attacks. however, the public key encryption is used to exchange a single master key which is used to generate the two symmetric keys, as well as some other keys used in other parts of the TLS protocol (such as MAC keys used for integrity).

For more details, see How does SSL/TLS work?

|improve this answer
$\endgroup$
0
$\begingroup$

Very generally(!) AFAIK:

Step 4 ("-Server uses...") should be: Client creates a key S and uses server's public key to encrypt S and send it to the server, after which S is used as a symmetric key by both.

|improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.