Kuidas toimub sõnumite krüpteerimine brauseri ja serveri vahel?

Encryption between the browser and the server is carried out using the HTTPS protocol, which is an extension of HTTP using SSL/TLS protocols (Secure Sockets Layer / Transport Layer Security).

The process of establishing a secure connection (Handshake):

1. Client Hello: The browser sends a message to the server containing supported SSL/TLS versions, a list of cipher suites, compression algorithms, and a random number (from the client).
2. Server Hello: The server selects the best protocol version, cipher suite, and compression algorithm from those offered by the browser, generates its own random number (from the server), and sends them to the browser along with its SSL/TLS certificate.
3. Authentication: The browser verifies the server's certificate:
   • Trustworthiness of the root certification authority (Root CA).
   • Validity period of the certificate.
   • Domain name match in the certificate with the website address.
   • Absence of the certificate in the revoked list (CRL or OCSP).
4. Premaster Secret: The browser generates a random number (premaster secret), encrypts it with the server's public key (from the certificate), and sends it to the server.
5. Session Key Generation: Both the browser and the server use the client (Client Random), server (Server Random) random numbers, and the premaster secret to generate a symmetric session key.
6. Change Cipher Spec: The browser sends a message to the server indicating the transition to using the generated session key for further communication.
7. Finished: The browser sends the hash of all previous handshake messages, encrypted with the session key. This message verifies the correctness of the handshake.
8. Change Cipher Spec: The server sends a message to the browser about switching to encrypted communication.
9. Finished: The server sends the hash of all previous handshake messages, encrypted with the session key.

After a successful handshake, all subsequent data transfer between the browser and the server occurs using symmetric encryption based on the generated session key. Symmetric encryption is much more efficient than asymmetric, making it suitable for encrypting large volumes of data.

Applicable algorithms (examples):

• Asymmetric encryption (for session key exchange): RSA, Diffie-Hellman (DH), Elliptic Curve Diffie-Hellman (ECDH).
• Symmetric encryption (for data encryption): AES, 3DES, ChaCha20.
• Hashing (for message integrity verification): SHA-256, SHA-384.