3 ms·

Genuinely curious, as HTTPS is something I do not fully understand even with this simplification: If the browser's symmetric key is encrypted with icicibank's

Genuinely curious, as HTTPS is something I do not fully understand even with this simplification: If the browser's symmetric key is encrypted with icicibank's public key, why can't a sniffer unlock it by also requesting icicibank's public key and decrypting the key sharing message?

lmz 9y ago
Only the private key can decrypt it. This is the difference between asymmetric and symmetric encryption algorithms.
usmannk 9y ago
The payload is encrypted with the bank's public key but it can only be decrypted with their private key. This is the basis of public key cryptography [1]. [1] https://en.wikipedia.org/wiki/Public-key_cryptography https://en.wikipedia.org/wiki/Public-key_cryptography
- schoen 9y ago
  It's quite counterintuitive that this is possible at all. We didn't even know a way to make it work until the 1970s!
- theEXTORTCIST 9y ago
  When talking HTTPS it's important to note that the protocol uses both asymmetric and symmetric key encryption. Asymmetric key exchange for secure session setup / authentication Symmetric key for secure session data encryption https://tools.ietf.org/html/rfc4346#section-1 https://tools.ietf.org/html/rfc4346#section-1
nitinreddy88 9y ago
you can encrypt with public key, but it cant be decrypted with same key. its assymetric encryption.
valarauca1 9y ago
Public Key encryption is like a bank deposit box. Anyone can encryption (put things in), but only the Private Key (the bankers) can decrypt (see whats inside).
serenata 9y ago
> If the browser's symmetric key is encrypted with icicibank's public key For Diffie-Helman key exchange, atleast... Encrypting/"locking" uses the public key. Unlocking a public-key-encrypted-symmetric-key happens with icicibank's private key, which the sniffer does not have. Here's another diagram: https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange#Description https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exc...
bogomipz 9y ago
The content is actually pretty terrible and not likely to help anyone understand much about TLS. This however is a decent resource for learning the things you're asking about such as public key crypto, asymetric vs symetric, digital signatures, etc. Specifically weeks 5 and 6. The whole course is good though. https://www.coursera.org/learn/crypto#syllabus https://www.coursera.org/learn/crypto#syllabus
mattlondon 9y ago
Just to clarify other people's responses to make this ultra clear for people learning: - stuff encrypted with the private key can only be decrypted using the public key. - stuff encrypted with the public key can only be decrypted using the private key. This is why the public key can be distributed around freely and anyone can use it to encrypt, because only the person with the private key can decrypt it (and this is why you really need to keep your private key secure!) The flip side is anyone can decrypt something encrypted with the private key (since the public key is widely known). But this is how we can verify that the other server really is who they say they are - remember that the public key can only decrypt stuff encrypted with the private key, so if we can decrypt something from the server then we know that they encrypted it using the private key and are therefore probably legit (...or the private key got leaked or CIA/Snowdon etc) Enjoy learning! :)

lmz 9y ago

Only the private key can decrypt it. This is the difference between asymmetric and symmetric encryption algorithms.

usmannk 9y ago

The payload is encrypted with the bank's public key but it can only be decrypted with their private key. This is the basis of public key cryptography [1]. [1] https://en.wikipedia.org/wiki/Public-key_cryptography https://en.wikipedia.org/wiki/Public-key_cryptography

schoen 9y ago
It's quite counterintuitive that this is possible at all. We didn't even know a way to make it work until the 1970s!
theEXTORTCIST 9y ago
When talking HTTPS it's important to note that the protocol uses both asymmetric and symmetric key encryption. Asymmetric key exchange for secure session setup / authentication Symmetric key for secure session data encryption https://tools.ietf.org/html/rfc4346#section-1 https://tools.ietf.org/html/rfc4346#section-1

nitinreddy88 9y ago

you can encrypt with public key, but it cant be decrypted with same key. its assymetric encryption.

valarauca1 9y ago

Public Key encryption is like a bank deposit box. Anyone can encryption (put things in), but only the Private Key (the bankers) can decrypt (see whats inside).

serenata 9y ago

> If the browser's symmetric key is encrypted with icicibank's public key For Diffie-Helman key exchange, atleast... Encrypting/"locking" uses the public key. Unlocking a public-key-encrypted-symmetric-key happens with icicibank's private key, which the sniffer does not have. Here's another diagram: https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange#Description https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exc...

bogomipz 9y ago

The content is actually pretty terrible and not likely to help anyone understand much about TLS. This however is a decent resource for learning the things you're asking about such as public key crypto, asymetric vs symetric, digital signatures, etc. Specifically weeks 5 and 6. The whole course is good though. https://www.coursera.org/learn/crypto#syllabus https://www.coursera.org/learn/crypto#syllabus

mattlondon 9y ago

Just to clarify other people's responses to make this ultra clear for people learning: - stuff encrypted with the private key can only be decrypted using the public key. - stuff encrypted with the public key can only be decrypted using the private key. This is why the public key can be distributed around freely and anyone can use it to encrypt, because only the person with the private key can decrypt it (and this is why you really need to keep your private key secure!) The flip side is anyone can decrypt something encrypted with the private key (since the public key is widely known). But this is how we can verify that the other server really is who they say they are - remember that the public key can only decrypt stuff encrypted with the private key, so if we can decrypt something from the server then we know that they encrypted it using the private key and are therefore probably legit (...or the private key got leaked or CIA/Snowdon etc) Enjoy learning! :)