Ok, so been looking up public key encryption and using it a bit around some of my web applications. From some testing, I understand that the server contains two keys and sends the public key to the client.

With this kind of system, the client can send encrypted data.

My question is however, how does the SERVER send data securely to the client?


  • Why aren't you using SSL which does this all already? – Neil Smithline Nov 25 '15 at 22:21

Client generates a symmetric key, encrypts it with server public key and sends it to server. Server decrypts with private key and uses that as a network session key to speak securely with client. This is basically what TLS_RSA does.

| improve this answer | |

1. Handshake

It all starts first with a handshake. The client tells the server what version of SSL it supports and what cipher suites. The server answers with the information on which version of SSL and which cipher suite will be used.

2. Cerfiticate

The client now has to check if the server really is who he sais he is. This is done with the certificate. The client verifies the name of the holder, the domain, public key, signature and the date when it will expire. The check of these information is done by asking the certificate authorities if it is valid or not.

3. Key exchange

Now that everything is almost set up, the client generates a random symmetric key that will be used for encrypting the data sent back and forth between the client and the server. (note: both ways are encrypted!) The client then encrypts this symmetric key with the asymmetric public key of the server and sends this information to the server. Only the server can read this data, because it only can be decrypted using its private key. So now both parties have the symmetric key that will be used to encrypt and decrypt the data of the communication.

The reason why there is a symmetric key is because of performance. Using only the asymmetric public key of the server would be much to slow and is even bound on limitation of the size of the data. And as you pointed out, the server otherwise couldn't send encrypted data back to the client.

I hope this gives you a brief understanding in how SSL works.

| improve this answer | |
  • Cerfiticate -> Certificate ​ ​ – user49075 Nov 25 '15 at 9:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.