Sobes.tech
Interview Help
Resources
Interview Preparation
Resources
Job Search
Resources
Legal
Back to questions
Middle

How is message encryption between the browser and the server performed?

sobes.tech AI

Answer from AI

Encryption between the browser and the server is carried out using the HTTPS protocol, which is an extension of HTTP with SSL/TLS (Secure Sockets Layer / Transport Layer Security) protocols.

The process of establishing a secure connection (Handshake):

  1. Client Hello: The browser sends a message to the server containing supported SSL/TLS versions, a list of cipher suites, compression algorithms, and a random number (client).
  2. Server Hello: The server selects the best protocol version, cipher suite, and compression algorithm from those offered by the browser, generates its own random number (server), and sends them to the browser along with its SSL/TLS certificate.
  3. Authentication: The browser verifies the server's certificate:
    • Trustworthiness of the root certification authority (Root CA).
    • Validity period of the certificate.
    • Domain name in the certificate matches the website address.
    • The certificate is not listed in the revocation list (CRL or OCSP).
  4. Premaster Secret: The browser generates a random number (premaster secret), encrypts it with the server's public key (from the certificate), and sends it to the server.
  5. Session Key Generation: Both the browser and the server use the client random, server random, and premaster secret to generate a symmetric session key.
  6. Change Cipher Spec: The browser sends a message to the server indicating the switch to using the generated session key for further communication.
  7. Finished: The browser sends the server a hash of all previous handshake messages, encrypted with the session key. This message verifies the correctness of the handshake.
  8. Change Cipher Spec: The server sends a message to the browser indicating the switch to encrypted communication.
  9. Finished: The server sends the browser a hash of all previous handshake messages, encrypted with the session key.

After a successful handshake, all subsequent data transfer between the browser and the server occurs using symmetric encryption based on the generated session key. Symmetric encryption is much more efficient than asymmetric, making it suitable for encrypting large volumes of data.

Algorithms used (example):

  • Asymmetric encryption (for exchanging the session key): RSA, Diffie-Hellman (DH), Elliptic Curve Diffie-Hellman (ECDH).
  • Symmetric encryption (for data encryption): AES, 3DES, ChaCha20.
  • Hashing (for message integrity verification): SHA-256, SHA-384.
PreviousNext