I have these doubts regarding authentication in SSL/TLS :
Will there be an authentication involved for all SSL connections ? For eg. when I browse the internet, using the most up-to-date browser, can I assume that there is always authentication involved ? From other questions I learnt that they are mostly to avoid a MITM. But is it optional/mandatory ? RFC says,
This authentication can be made optional, but is generally required for at least one of the peers.
If yes, does it always depend on the server certificate key size ? Say for eg: RSA public key size 2048, DSA key size 256.
- When referring to the cipher suite used for SSL - is it okay to say the authentication happened with the
<server_cert_key_size>? ( Considering I'm using cipher suite :
TLS_<Keyexchange>_<Auth>_<EncCipher>_<MAC>). I know the authentication mechanism differs by the type of key exchange (DHE vs. RSA), but is the usage of
Sorry for asking 3 questions in one. But they are very much related.
EDIT: To rephrase, and to be precise - is SSL/TLS authentication only as strong as the server certificate key size ?