TLS Handshaking - Revision history

Iwiseman: /* Diffie-Hellman Key Exchange */

2025-12-09T23:04:06Z

Diffie-Hellman Key Exchange

← Older revision		Revision as of 23:04, 9 December 2025
Line 30:		Line 30:
	<br>		<br>
	So to put it into English, the maths dictates when one side shares a public value and combines it with their public value and private value the number will be the same.<br>		So to put it into English, the maths dictates when one side shares a public value and combines it with their public value and private value the number will be the same.<br>
	[File:Diffie.png]		[[File:Diffie.png]]

	== Elliptic Curve Diffie-Hellman (ECDHE) ==		== Elliptic Curve Diffie-Hellman (ECDHE) ==

Iwiseman: /* Diffie-Hellman Key Exchange */

2025-12-09T23:03:49Z

Diffie-Hellman Key Exchange

← Older revision		Revision as of 23:03, 9 December 2025
Line 28:		Line 28:
	** Each side combines its private key with the other’s public key to compute the same shared secret.		** Each side combines its private key with the other’s public key to compute the same shared secret.
	* '''Security''': An eavesdropper cannot compute the shared secret without knowing one of the private ephemeral keys.		* '''Security''': An eavesdropper cannot compute the shared secret without knowing one of the private ephemeral keys.
			<br>
			So to put it into English, the maths dictates when one side shares a public value and combines it with their public value and private value the number will be the same.<br>
			[File:Diffie.png]

	== Elliptic Curve Diffie-Hellman (ECDHE) ==		== Elliptic Curve Diffie-Hellman (ECDHE) ==

Iwiseman at 22:40, 9 December 2025

2025-12-09T22:40:02Z

← Older revision		Revision as of 22:40, 9 December 2025
Line 1:		Line 1:
	=Introduction=		=Introduction=
	This page is just to remind me how this works		This page is just to remind me how this works
	= TLS Handshake ~~(TLS 1.3)~~ =		= TLS Handshake and Ephemeral Keys =

	== Overview ==		== Overview ==
	The ~~TLS~~ handshake ~~creates~~ a shared ~~secret (~~session key~~) between the client and server so their~~ traffic ~~is encrypted and authenticated~~.		Transport Layer Security (TLS) is the protocol that secures communication between a client and a server.
			It provides encryption, authentication, and integrity. The handshake process establishes a shared session key
			used for encrypting all subsequent traffic.

	== ~~Steps~~ ==		== TLS Handshake (TLS 1.3) ==
	# '''Client Hello''': The client ~~starts~~ the handshake, sending supported TLS versions, cipher suites, and a random value.		# '''Client Hello''': The client initiates the handshake, sending supported TLS versions, cipher suites, and a random value.
	# '''Server Hello + Certificate''': The server chooses a cipher suite, sends its certificate (public key + identity), and its random value.		# '''Server Hello + Certificate''': The server chooses a cipher suite, sends its certificate (public key + identity), and its own random value.
	# '''Ephemeral Key Exchange (ECDHE)''': Client and server exchange ephemeral public keys. Each side uses its private ephemeral key and the ~~other side’s~~ public ephemeral key to compute the same shared secret.		# '''Ephemeral Key Exchange (ECDHE)''': Client and server exchange ephemeral public keys. Each side uses its private ephemeral key and the other’s public ephemeral key to compute the same shared secret.
	# '''Session Key Derivation''': Both sides derive a symmetric session key from the shared secret and random values. This key is never sent over the network.		# '''Session Key Derivation''': Both sides derive a symmetric session key from the shared secret and random values. This key is never sent over the network.
	# '''Secure Communication''': All application data is encrypted with the symmetric session key. Only the client and server can decrypt it.		# '''Secure Communication''': All application data is encrypted with the symmetric session key. Only the client and server can decrypt it.

	== ~~Notes~~ ==		== Ephemeral Keys ==
	* '''~~Authentication~~''': ~~The server’s certificate lets~~ the ~~client verify the server’s identity (when the client trusts the certificate’s issuer)~~.		* '''Definition''': Ephemeral means temporary, single-use keys created only for the duration of one TLS session.
	* '''~~Forward Secrecy~~''': ~~Ephemeral keys ensure that even~~ if a server’s long-term private key is stolen later, past traffic cannot be decrypted.		* '''Purpose''': They provide '''forward secrecy'''. Even if a server’s long-term private key is stolen later, past traffic cannot be decrypted.
			* '''Lifecycle''': Generated at the start of the handshake, used to derive the session key, and then discarded.

			== Diffie-Hellman Key Exchange ==
			* '''Goal''': Allow two parties to compute the same shared secret without sending the secret itself over the network.
			* '''Process''':
			** Each side generates a private ephemeral key.
			** Each side computes a public ephemeral key from its private key.
			** They exchange public ephemeral keys.
			** Each side combines its private key with the other’s public key to compute the same shared secret.
			* '''Security''': An eavesdropper cannot compute the shared secret without knowing one of the private ephemeral keys.

			== Elliptic Curve Diffie-Hellman (ECDHE) ==
			* '''ECDHE''' is a modern variant of Diffie-Hellman that uses elliptic curves.
			* '''Advantages''':
			** Stronger security per bit compared to classic DH.
			** Faster computations, making it efficient for TLS 1.3.
			* '''Usage''': TLS 1.3 almost always uses ECDHE for its key exchange.

			== Session Key ==
			* Derived from the shared secret and random values exchanged during the handshake.
			* Used for symmetric encryption (e.g., AES, ChaCha20).
			* Never transmitted; both client and server compute it independently.
			* Ensures that only the client and server can encrypt and decrypt the traffic.

			== Identity Verification ==
			* The server’s certificate allows the client to confirm the server’s identity.
			* With '''SslMode=VerifyFull''' (in Npgsql), the client checks:
			** The certificate is signed by a trusted CA (RootCertificate).
			** The hostname matches the certificate’s Subject Alternative Name (SAN).
			* If verification fails, the connection is refused.

Iwiseman: Created page with "=Introduction= This page is just to remind me how this works = TLS Handshake (TLS 1.3) = == Overview == The TLS handshake creates a shared secret (session key) between the client and server so their traffic is encrypted and authenticated. == Steps == # '''Client Hello''': The client starts the handshake, sending supported TLS versions, cipher suites, and a random value. # '''Server Hello + Certificate''': The server chooses a cipher suite, sends its certificate (public..."

2025-12-09T22:36:53Z

Created page with "=Introduction= This page is just to remind me how this works = TLS Handshake (TLS 1.3) = == Overview == The TLS handshake creates a shared secret (session key) between the client and server so their traffic is encrypted and authenticated. == Steps == # '''Client Hello''': The client starts the handshake, sending supported TLS versions, cipher suites, and a random value. # '''Server Hello + Certificate''': The server chooses a cipher suite, sends its certificate (public..."

New page

=Introduction=
This page is just to remind me how this works
= TLS Handshake (TLS 1.3) =

== Overview ==
The TLS handshake creates a shared secret (session key) between the client and server so their traffic is encrypted and authenticated.

== Steps ==
# '''Client Hello''': The client starts the handshake, sending supported TLS versions, cipher suites, and a random value.
# '''Server Hello + Certificate''': The server chooses a cipher suite, sends its certificate (public key + identity), and its random value.
# '''Ephemeral Key Exchange (ECDHE)''': Client and server exchange ephemeral public keys. Each side uses its private ephemeral key and the other side’s public ephemeral key to compute the same shared secret.
# '''Session Key Derivation''': Both sides derive a symmetric session key from the shared secret and random values. This key is never sent over the network.
# '''Secure Communication''': All application data is encrypted with the symmetric session key. Only the client and server can decrypt it.

== Notes ==
* '''Authentication''': The server’s certificate lets the client verify the server’s identity (when the client trusts the certificate’s issuer).
* '''Forward Secrecy''': Ephemeral keys ensure that even if a server’s long-term private key is stolen later, past traffic cannot be decrypted.