Okay, so now we'll talk about hybrid cryptography.
So we've talked about how symmetric cryptography has speed but also
has a number of faults.
And then we talked about how asymmetric cryptography solved a
lot of those problems, but it's slow.
So ultimately what I want is the speed of symmetric and
all the other service of asymmetric.
So in this section, we'll combine them into hybrid cryptography to
get the best of both worlds.
Okay, again, what we like to achieve is privacy
authenticity Integrity non repudiation
and speed we want it all.
Now in my mind the best way to see this is what
I have on this slide.
But let me draw it out for you so you can follow along.
I will be honest with you. I'm not the best artist on the
planet. So I use PowerPoint to draw and even that
is not the greatest. So bear with me.
So first, I have my client.
This is the computer that is going to want to connect and send information.
We'll use this scenario with SSL and TLS.
We also have the web server for Bank of America.
My client wants to have a secure connection to the Bank of America.
To have secure connection it would use the protocol https.
The client is going to send a command specifying the
protocol https and that says let's have
a secure connection.
And the bank server is going to say okay, and it
knows that the client wants the server's public key.
So the bank server sends the public key to the client.
So what we're looking at so far is asymmetric cryptography.
But here's the problem.
In addition to the fact that asymmetric cryptography is slow with
the banks public key only the client can send encrypted
messages to the bank.
The client doesn't have a public key to send to the bank set. The
bank can send encrypted messages back to the client.
Many people don't have public keys.
So this asymmetric cryptography by itself won't work
for the situation.
So the third step is where these things get interesting.
In the third step the client generates a symmetric
session key.
Now remember with the symmetric session key
the client generated the key and the client knows what
it is.
But the trick is at the bank needs the key so that a
secure session can be installed.
Is there anything the client has that can be used to encrypt the
session key set. Only the bank kindercrypt it.
Yes, it's the banks public key.
For the client encrypts the sessions key with the
banks public key.
So in the end we've exchanged a symmetric session key securely
so that way we can communicate with symmetric cryptography.
Because both parties know the symmetric key that is
going to be used to encrypt data for the bank server and also for the
client.
It took a little bit of back and forth, but there is not an easy
way to distribute a symmetric key.
So we used asymmetric key exchange and then
we had symmetric data Exchange.
Now if on the test they ask is SSL or TLS symmetric
or asymmetric?
Well, the best answer is that it's hybrid.
But they may not let you choose that answer. So if you have to
choose between symmetric and asymmetric then call it
asymmetric.
That's because we start with the process with the public key, which is
asymmetric cryptography.
They could ask what type of cryptography SSL use.
And that's asymmetric.
If they ask what type of cryptography SSL uses to encrypt data
in that case, it's symmetric.
The key exchange for ssls asymmetric. The
data exchange is symmetric.