0

According to Wikipedia, in the following cipher suite:

TLS_ECDHE_RSA_WITH_AES_GCM_SHA256

The RSA part denotes the "authentication mechanism during the handshake".

And I'm confused, since from what I know it works like this: The server sends a certificate (let it be a X509 certificate) to the client. Now the client needs to do 2 things: A. he needs to verify the signature of the certificate, given the name of the CA. B. He needs to verify that the private key that corresponds to the subject's public key indeed is held by the subject.

In order to do the first, the certificate contains the "Certificate Signature Algorithm" so the client knows what algorithm is used to verify the signature.

In order to do the second, the client needs to encrypt something with the subject's public key. For this, it needs to know what algorithm should be used to encrypt with. For that, the certificate contains a section of "Subject Public key Information", which in turn includes "Subject Public Key" and "Public Key Algorithm".

So what I don't understand is, why is this part of the cipher suite? and, must the server pick a suite with the Authentication algorithm corresponding to the one of the certificate?

1 Answer 1

1

It is not about the client knowing what authentication method is used by the server, but about the client communicating what authentication methods are acceptable to the client. This is necessary so that the server can provide the authentication method actually supported by the client.

Like with the other parts of the cipher client and server might support multiple authentication methods, i.e. certificate based like RSA, ECDSA or methods without certificates like PSK. Up to TLS 1.2 the client announced its support as part of the cipher, with TLS 1.3 this is done as separate extensions outside of the cipher.

2
  • so, supposing the client ciphers suites list only contains RSA as authentication method, and the server certificate's contains a DSA public key, they won't be able to establish a connection?
    – YoavKlein
    Dec 14, 2021 at 9:35
  • @YoavKlein: correct. In this case there is no shared cipher between what the client offers and what the server supports. Dec 14, 2021 at 9:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.