I'm trying to understand the full flow of key exchanges for secure communications.

As a potentially incorrect premise, I am under the impression that RSA is a good asymmetric technique for establishing a secure connection through which a subsequent symmetric key exchange can occur and that the AES cipher block is a better method for high volume message exchanges because it's faster than RSA encryption. Meaning, RSA asymmetric is good for an exchange of a small message such as a shared [session] secret key.

With that said, I understand the flow between Alice and Bob as follows:

  1. Alice sends ClientHello to Bob (Server)
  2. Bob responds with Acknowledgement
  3. Alice responds with a Public Key (RSA's public half)
  4. And (potentially?) a Message Digest which consists of a one-way hash (such as sha()) of Alice's public key that was encrypted by Alice's Private Key
  5. Bob receives Alice's public key, uses it to decrypt the one way hash, uses the same hashing function (sha()) to hash the public key and then compares the decrypted one-way hash from Alice and the one-way hash he generated
  6. If it matches, he believes the connection and sends his own public key to Alice
  7. Along with that Public key, he sends a one-way hash of his key (maybe concatenated with Alice's public key?) with which Alice can repeat the process of decrypting using Bob's public key and then comparing the one-way hash of his key (or maybe of his key combined with Alice's public key?)
  8. Once the two parties can see that there is a secure connection (because of each having a hash match), they can a) store their respective public keys and b) make an exchange of a secret symmetric session key that would then follow AES for more high volume message exchanges

Is this correct? Is it more common for simply the RSA key exchange to be done? is this the correct method for key exchange? Is this an accurate representation of TLS1.2? Have I invented any steps?

I know this is a lot of questions with potentially more than one area I've misunderstood the processes. I appreciate the clarification and help!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.