Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Let's assume that I am logging into my Gmail account from my browser using my username and password. I know that my input will be encrypted using Google's private key and the only one who can decrypt it is Google's server. So Google's server will read it and send the response to me using WHAT key?
I am thinking “if Google uses their own private key then the man-in-the-middle could decrypt the response using Google's public key and can read my emails”
How is the response secured then?
During the TLS handshake, your browser and Google's server negotiate a secret symmetric key that is known only to your browser and Google's server. Your browser encrypts the http request using this symmetric key and sends the encrypted request to Google's server. Then, Google's server encrypts the response using this same symmetric key, and sends the encrypted response back to your browser.
This is perhaps somewhat of an oversimplification, but see https://www.moserware.com/2009/06/first-few-milliseconds-of-https.html for some interesting reading on this subject if you are interested in more detail as to how all of this happens. Note, this write-up is based on TLS 1.0, which is an older TLS protocol. Newer versions of TLS (such as TLS 1.2 and TLS 1.3) use a more complicated handshake, so it may be better to start by getting a handle on TLS 1.0 first.
