Why this matters
The padlock in the address bar is doing more work than it looks. In the moment between clicking a link and seeing a page, your browser has checked that the server is genuine, agreed a secret with it that nobody watching could have learned, and switched to a faster kind of encryption for everything after. Understanding why it needs two kinds of cryptography, not one, is the whole idea of this lesson.
The idea
HTTPS is HTTP with TLS encryption added. It gives you three things at once: communication nobody else can read, detection if it is altered, and proof of who you are connected to. The setup procedure is the TLS handshake.
It works in three stages, and the kind of cryptography changes partway through:
| Stage | What happens | Cryptography |
|---|---|---|
| Connection | The server sends a digital certificate and a public key; the browser checks it against a certificate authority | Public-key |
| Key exchange | The browser makes a common key, encrypts it with the server's public key, and sends it; the server decrypts it with its private key | Public-key |
| Data | Both sides encrypt and exchange the real data with that shared common key | Common-key |
The reason for the switch is the point of the lesson. Public-key cryptography is how you share a key safely with someone you have never met. It is also slow. Common-key cryptography is fast but useless until both sides already share a secret. So each is used for the job it is good at: public-key to share the key, common-key to move the data. Doing everything with public-key would be secure and unusably slow.
(The book shows one way a common key can be shared. Current TLS versions use Diffie-Hellman key agreement instead, but the division of labour is the same.)
Authentication layers the same way. There are three factors: knowledge (something you know), possession (something you have), and biometric (something you are). Multi-factor authentication means combining two or more different ones. Two passwords is not multi-factor, because both are knowledge, and one leak breaks both.
Security in practice is always a combination:
| Technology | What it stops |
|---|---|
| Encryption | Third parties reading the traffic |
| Digital signature | Tampering and impersonation, and denial afterwards (non-repudiation) |
| Digital certificate | Talking to a fake server |
| Multi-factor authentication | Unauthorised logins |
Picture it
sequenceDiagram participant B as Browser participant S as Server S->>B: certificate + public key Note over B: verify against the certificate authority B->>S: common key, encrypted with the public key Note over S: decrypt with the private key B-->>S: data encrypted with the shared common key S-->>B: data encrypted with the shared common key
Worked example
You buy something from an online shop. Four technologies run, each against a different threat.
You open the site and HTTPS starts, so encryption stops anyone on the same network reading what you send. Your browser checks the digital certificate, which is what catches a convincing fake shop at a lookalike address. You log in with a password plus a code sent to your phone, so multi-factor authentication means a leaked password alone is not enough to order in your name. When the order goes, a digital signature means a changed quantity or address would be detected, and you cannot later claim you never placed it.
None of these substitutes for another. Encryption does not tell you the shop is real; a certificate does not stop a stolen password. Eavesdropping, tampering, impersonation and unauthorised login are four separate problems, answered by four separate tools.
Your turn
Try the practice questions for this lesson. Judge statements about which cryptography HTTPS uses where, match each threat to the technology that answers it, and work out why the two kinds of cryptography are split the way they are.
Take it further
A school is building a portal where students check grades and pay fees. Should logging in need a password only, or a password plus a one-time code sent to a phone?
- Collect data. Ask ten classmates which login methods they use and trust: password, one-time code, SMS, fingerprint, face.
- Analyse the stakeholders. For a student, for the school, and for a student with no smartphone, note one benefit and one drawback of requiring a second factor.
- Decide. Recommend one method and give two reasons from your survey and your table.
The third group again decides it. Security that excludes some students from their own grades has traded one problem for another.
Recap
- HTTPS uses public-key cryptography to share a key and common-key cryptography for the data.
- The split exists because public-key is safe for key sharing but too slow for bulk data.
- A digital certificate proves who the server is; a digital signature proves data was not altered and gives non-repudiation.
- Multi-factor authentication needs two different factors. Two passwords is not multi-factor.