Search code examples
javasslencryptionprivate-keyencryption-asymmetric

SSL use symmetric or asymmetric?


So far what I understand:

  1. Sender starts the handshake with server.
  2. Server generates a pair of Public and Private key using asymmetric encryption and re-encrypt the Public key alone using symmetric encryption. And passes the Public key to the sender.
  3. Sender encrypt the message using the Public key and sends the encrypted message to server.
  4. Server decrypt the message using symmetric encryption and then decrypt the message again using the Private key.

Is this the right way how a SSL encryption works?? Please correct me.


Solution

  • Sender starts the handshake with server.

    Client starts handshake with server.

    Server generates a pair of Public and Private key using asymmetric encryption and re-encrypt the Public key alone using symmetric encryption.

    No.

    And passes the Public key to the sender.

    No. It sends its certificate to the client and they then start a secret-key negotiation.

    Sender encrypt the message using the Public key

    No. It uses a symmetric session key negotiated during the handshake.

    and sends the encrypted message to server.

    Yes.

    Server decrypt the message using symmetric encryption

    Yes.

    and then decrypt the message again using the Private key.

    No.

    Is this the right way how SSL encryption works?

    No.