Transport & Network Security

Transport and Network Security · Open board

The handshake and the certificate chain running behind every browser’s padlock icon, drawn as the two sides actually exchange them.

Before you start. Cryptography Foundations gave you the three tools this lesson wires together: a shared key that locks and unlocks the same way on both ends, a public key whose lock only its private twin can open, and a signature that proves who sent something. The whisper code (how a call goes private) showed two people agreeing on a private way to talk without having met first; this lesson is that trick, running for real, between your browser and a stranger’s server, in under a tenth of a second.

The idea in 30 seconds

In October 2010, sites that only scrambled the login page let a free tool called Firesheep read strangers’ Facebook and Twitter sessions off public Wi-Fi - nothing was cracked, the rest of the conversation was simply never locked.
TLS scrambles every message between a browser and a server, and checks the server’s identity before any of that scrambled data starts flowing.
The handshake is the browser and server agreeing on a one-time secret, the session key, in a single exchange, without ever sending that secret itself over the wire.
A certificate is a signed claim that a server is who it says it is, and it’s only trusted because whoever signed it is trusted too, in a chain that ends at a name the browser shipped with.
TLS protects data crossing the wire. It does nothing for data already sitting on a disk, in a log file, or in a database once it arrives.

Read the story · Skip to the numbers