Module 12 · Security
Unit 47 of 49
Unit 47 · Module 12 · Security
It proves the server is who it claims. It says nothing about the client, and nothing about the code.
Unit 47 of the free 49-unit computer-science course, in security. 1 topic to watch or read, 2 interview questions answered in full and a short self-check.
One topic makes up this unit. Take each one whichever way suits you, then answer the questions below.
Symmetric encryption uses one shared key (fast, hard to distribute). Asymmetric uses a public/private pair (solves key distribution, but slow). Real systems use both—like HTTPS and JWTs.
Asked out loud, answered out loud. Read the answer, then say it in your own words.
That the connection is encrypted, and that the server holds the private key for a hostname some certificate authority in your trust store vouched for. It does not prove the site is honest or that it is the company you had in mind — anyone can obtain a valid certificate for a domain they control, phishing sites included. It is a statement about the channel and the name, not about the business behind it.
Both, in sequence, because they are good at different things. Asymmetric solves the key-distribution problem — you can publish a public key — and it is slow. Symmetric is fast and needs both sides to already share a secret. So the handshake uses asymmetric cryptography to authenticate the server and agree a shared secret, and every byte after that is encrypted symmetrically with it.
Modern handshakes agree that secret with ephemeral Diffie-Hellman, which gives forward secrecy: stealing the server key later does not decrypt yesterday's traffic.
Answer alone, at 2am, with no interviewer in the room.
