Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Both a client and a server send their random number each other in the ClientHello and ServerHello of handshake protocol of TLS. At the time, how do they authenticate the client or server which they want to communicate?
They make sure that the same ones if the session is the same because there is Certificate and CertifcateRequest after ClientHello.
Could you please help me for understanding. Thank you!
There is no authentication at the time the random numbers are sent. Instead the client and server random are used as part of the string which is signed by by the server as part of the authentication (and also in the string which is signed by the client in mutual authentication). For this it is not needed that the random numbers are authenticated - all what is needed is that they are not predictable and not determined by only the server (in case of server authentication) or the client (in case of client authentication).
