I have these doubts regarding authentication in SSL/TLS :
- Will there be an authentication involved for all SSL connections ? For eg. when I browse the internet, using the most up-to-date browser, can I assume that there is always authentication involved ? From other questions I learnt that they are mostly to avoid a MITM. But is it optional/mandatory ? RFC says,
This authentication can be made optional, but is generally required for at least one of the peers.
- If yes, does it always depend on the server certificate key size ? Say for eg: RSA public key size 2048, DSA key size 256.
- When referring to the cipher suite used for SSL - is it okay to say the authentication happened with the
<server_cert_key_size>? ( Considering I'm using cipher suite :
TLS_<Keyexchange>_<Auth>_<EncCipher>_<MAC>). I know the authentication mechanism differs by the type of key exchange (DHE vs. RSA), but is the usage of
Sorry for asking 3 questions in one. But they are very much related.
EDIT: To rephrase, and to be precise - is SSL/TLS authentication only as strong as the server certificate key size ?