1

I realized all of the phase of the handshake but I do not understand how it does that from the two randomly generated numbers are unable to generate a session key that the client and the server uses for symmetric encryption . if someone explain to me how it works I would be very grateful

| improve this question | |
2

This is being done by using the

  • Diffie-Hellman key exchange protocol when you aim for Forward Secrecy (Authentication-Key = RSA, Encrpytion-Key = DH-negotiated)
  • RSA in non Forward Secrecy scenarios (Authentication/Encryption-Key = RSA).

The latter has the disadvantage that an attacker that can get hold of your private key can also decrypt all past communication - whereas this is not possible by using DH and therefore a different key for encryption.

| improve this answer | |
  • 1
    The RSA handshake is pretty common as well. – CodesInChaos Apr 27 '14 at 14:08
  • True - unfortunately. I was a bit too Forward Secrecy focussed. Good remark. – binaryanomaly Apr 27 '14 at 14:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.