Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I'm using the TLS cipher suite TLS_RSA_WITH_AES_256_CBC_SHA56. The Public Key of the Server's Certificate is RSA (2048 Bits)
I understand that the RSA algorithm is used here for for key exchange, as well as authentication.
Does the fact that the certificate contains an RSA 2048 bit public key mean that the length of the RSA key used for both Key Exchange and Authentication is 2048 bits?
Yes, it does mean exactly that that.
The pre-master secret in this protocol is a random generated by the client. It is simply encrypted using the public key from the certificate at the client and decrypted by the server using the corresponding private key. The pre-master secret is then used to calculate the master secret and the session keys.
The Finished message send by the server then shows that the server was able to decrypt the pre-master secret and derive all the key material: the finished message contains a MAC over all the messages using one of the derived keys.
This is all explained rather well in section F.1.1.2. RSA Key Exchange and Authentication:
...
After verifying the server's certificate, the client encrypts a
pre_master_secret with the server's public key. By successfully
decoding the pre_master_secret and producing a correct Finished
message, the server demonstrates that it knows the private key
corresponding to the server certificate....
The key size of the public and private key of the same key pair is always identical. For RSA it is identical to the minimum number of bits required to encode the modulus as unsigned value.
Note that there is just one RSA encryption and one decryption operation that is used for exchanging keys and entity authentication; these are not separate RSA operations. The authentication part also requires the MAC, otherwise the client doesn't know that the server indeed decrypted the pre-master secret correctly. The protocol might have also have gone for implicit authentication when receiving the first message and verifying the MAC of that, but fortunately it didn't.
