CODEWITHSUNDEEP
authenticationsslhttpsclient-serverpublic-key-encryption
Deepak
Deepak

Reputation: 1594

How exactly SSL works with asymmetric algorithm?

As I was reading about this and got confused about the keys while trying to understand using the following scenario.

Let say:

-A server S1

-And 3 Clients, C1, C2, C3

Let say C1 want to communicate with server.

How server will authenticate C1 ?

Similarly all the clients want to communicate with the server

Will there be only one public key for all the clients to encrypt the data ?

How a client possess a private key ?

Is it sent by the server ? or self generated ?

Upvotes: 0

Views: 49

Answers (2)

Steffen Ullrich
Steffen Ullrich

Reputation: 123375

How server will authenticate C1 ?

C1 will authenticate the server with the help of the servers certificate and by using public key cryptography based on the public key contained in the servers certificate in the CA certificates which signed directly or indirectly the servers certificate.

Will there be only one public key for all the clients to encrypt the data ?

The data will not be encrypted with the public key. Instead each of the client is doing a key exchange with the server which will results in keys for symmetric encryption (and HMAC) specific to the connection between client and server.

For way more details I recommend that you study How does SSL/TLS work? over at security.stackexchange.com which is also the more suitable site to ask such question.

Upvotes: 1

X. Liu
X. Liu

Reputation: 1110

I am not very sure whether the OP is asking about SSL in general or the client authentication in SSL. (Note that @zaph is wrong. Client authentication is an optional part of TLS. [2])

In client authentication, client generates its own public and private key pair locally. The client then sends the CSR to a certificate authority to obtain a certificate. This certificate is sent to the server when the server requests it. The server verifies the certificate in the usual way (similar as how browsers verify server certificates). If the client cert is valid, the server can use the identification info present in the cert to determine whether to allow the client or not.

[2] https://www.rfc-editor.org/rfc/rfc5246#section-7.4.6

Upvotes: 1

Related Questions