0

I have a client how asks a token from an auth server in order to use it to an endpoint which serves as the resource server.

Between the client and the server, a handshake is utilized in order the two parties authenticate with each other.

In the normal TLS handshake procedure, the client sents a symmetric key to the server

In my case does this is necessary? Or after the authentication part has completed the handshake can be finished?

Improve this question
2
  • For this question and your other recent questions, see tlseminar.github.io/first-few-milliseconds for a walk-through of how keys are exchanged in TLS 1.2, with TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (which is Key Exchange: Elliptic curve diffie-hellman, signed with RSA, Encryption: AES in GCM mode with 128 bit keys, MAC: SHA256). – mti2935 Dec 22 '20 at 18:01
  • @mti2935 thank you this is a wonderful resource. Does there exist any comprehensive resource for this tools.ietf.org/html/draft-ietf-oauth-mtls-17? – loutsi1 Dec 22 '20 at 18:25
1

In the normal TLS handshake procedure, the client sents a symmetric key to the server

No. What you describe kind of resembles RSA key exchange, where the premaster secret is set by the client and sent encrypted to the server. They symmetric key and other keys are the derived from this. But RSA key exchange is considered obsolete and with Diffie-Hellman key exchange both parties compute a key together.

There is absolutely no difference in key exchange when client certificates are involved, no matter if RSA of DH key exchanged is used.

Improve this answer
3
  • thanks again. I am not sure that I understand your answer. The key exchange happens because the two parties want to exchange secure information with each other. So they want to build a secure channel.In my case is necessary for the parties to have a secure channel? Maybe because the authserver will return a token back to the flask? – loutsi1 Dec 22 '20 at 15:03
  • or maybe the steps from here are enough? benpournader.medium.com/what-is-two-way-tls-d90600e2fc06 – loutsi1 Dec 22 '20 at 15:06
  • @loutsi1: I'm not sure what you are asking. The title of your question is about symmetric keys in mutual TLS and this is what the answer is about. This is independent from what this mutual TLS is actually used for, i.e. no matter if oauth2 is involved or not. – Steffen Ullrich Dec 22 '20 at 15:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.