How does the key exchange in HTTPS work?

In this small blog post we will have a look at how HTTPS works. Well, we will look how the cryptographic part works a bit more in detail.

The focus is on the Diffie Hellman Key algorithm, an asymmetric key exchange. We will see what an asymmetric and a symmetric key exchange is.


What we want is easy, Alice and Bob want to communicate in a private fashion over a public channel. Public channel means everybody can listen to their conversion (in our case Tom).


So to make that work we have to find a way to encrypt the messages between those two. Encryption means we need a function which takes a raw and readable input and transforms this into an output, which can only be understood by well-defined actors. One way of making this work is to share a secret beforehand. As Alice and Bob never met in real life, they can't do that so they have to find a way to share or create a secret on the fly. And that is where the Diffie Hellman key exchange comes into play.


What you saw is an asymmetric key exchange. This means that every party always deals with two kind of keys: A public key which is use to decrypt the message and a private key which is used to encrypt a message. A symmetric key exchange only has one single key, which is used for both actions. The advantage of asymmetric encryption is, that it's generally safer but takes more bandwidth and more performance. A symmetric one is faster, but if you get into the possession of said key, than you can decrypt and encrypt every message. We will later see how they play together. Let's first have a small math example how does this public exchange work with private and public key so that Tom can't read Alice or Bob's messages.


Now those numbers in the example are very small, so you can do trial and error until you can make sense of the message. In todays encryption (Stand 2022) we are dealing with prime numbers which are at least 22048 bit wide, so a number with over 600 digits.

The elegance why this works and why everyone can openly share the prime number plus the generator is simple: Discrete logarithm. As long as we can't solve that efficiently, we should be good for now.

Now we saw that this asymmetric key exchange is quite expensive and uses a few roundtrips to make it work. That is why that key is then only used to enable then symmetric encryption (now that we have a "secret channel"). So every other resource in the same domain and session is done via symmetric encryption (to be faster and more lightweight).

Prerendering Blazor Apps - How does it work / tips and tricks

Blazor comes with the option to prerender your webpage on the server. This works for the client-side version as well as the server side version of Blazor.

Let's have a look how does it work and what might be some pitfalls and how can we come around those.

The garbage collector in .NET - Part 2: Compacting

I already made a post about how the Garbage Collector works in .NET and also introduced the topic of Generation slightly. This article will look a bit more in detail into why we have those mechanisms in the first place, including the Large Object Heap.

Tutorial Unit and E2E Testing in Blazor - Part 2 Playwright Introduction

This time we will have a look at end to end testing. For this we are using the Playwright C# library from Microsoft. This is the second part of the series. Go here for Part 1

An error has occurred. This application may no longer respond until reloaded. Reload x