Today as technology is improving day by day, more and more security risks are coming in front of us and making them ineffective is also important as most of the people believe in shopping online with their personal information such as credit cards etc so making those information safe is the most important step while establishing an e-commerce website. For this problem OpenSSL plays a great role, the green lock shown on your browser’s URL bar actually shows that your information is safe on this website.
So how actually it works? OpenSSL uses some types of encryption which we will discuss now, we discussed one major problem for which we use cryptography, not only this but there are tons of other reason to study it and apply it. We’re going to study basic types of encryption to get an idea how actually cryptography works.
The first type is Symmetric Encryption in which single key is used to encrypt and decrypt the message sent by both of the parties, actually the server and the client. It used in SSL Handshake process in which both of the parties verify if they’re dealing with the right person.
The second type is Block Cipher in which specific bits of plain-text is converted into specific bits of cipher-text using specific bits of key, the encryption and decryption is done in blocks. Block Cipher works on a block of data so it requires more memory for computation as compared to the Stream Cipher which we’re going to discuss.
The third one is Stream Cipher which uses symmetric encryption, using one key for encryption as well as decryption. Stream Cipher actually work bit by bit of plain-text to turn it into a cipher-text using the key-stream which is a random key generated for encryption and decryption as its using symmetric encryption, It doesn’t process block of data as Block Cipher do so it is more faster than Block Ciphers.
Now lets discuss our last type of encryption which is Asymmetric Encryption. It is actually fully opposite of Symmetric encryption, it uses pair of keys; One key for encryption which is called Public Key and the other key for decryption which is called Private Key. In case of SSL the public key is provided freely as its embedded on its digital certificate but the Private Key is kept private on server as that is used for decryption, so keeping it private would make it a secure connection as no one would be able to decrypt the message sent except the one which has private key. If we look into SSL so we have a great example of Asymmetric encryption as SSL uses public key and private key for turning plain-text into cipher-text. The keys used in this process could be up to 1-24 bits in size.
As we know, using two pair of keys and keys could be up to 1024 bits or more in size. This took pretty much time so a new hybrid approach was introduced which is called Public Key Infrastructure (PKI) which actually used Asymmetric Encryption and Symmetric Encryption both. If we take its example in SSL so the client randomly generates a key which is called a symmetric key which is also called a session key, the only key which would be further used for encrypting and decrypting messages sent between both of the parties. The symmetric key is then encrypted using the public key and is sent to the server. Now the server decrypts that using its private key and now the Asymmetric encryption has ended. Now server and client would encrypt their messages using the symmetric key generated by the client which is now Symmetric encryption. By this way, its pretty faster than using two keys for communication between both of the parties.
That’s an overview of the basic cryptographic fundamentals, if there’s more to add or you have anything to say please share it in comments!