How does browser generate symmetric key during SSL handshake

user_393073 0
Viewed 6833

I have a small confusion on SSL handshake between browser and server in a typical https web scenario:

What I have understood so far is that in the process of SSL handshake, client (browser in this case) encrypts a randomly selected symmetric key with the public key (certificate received from server). This is sent back to the server, server decrypts it (symmetric key) with the private key. This symmetric key is now used during rest of the session to encrypt/decrypt the messages at both the ends. One of main reasons to do so is given as faster encryption using symmetric keys.

Questions

1) How does browser pick and generates this "randomly" selected symmetric key?

2) Do developers (or/and browser users) have control on this mechanism of generating symmetric keys?

browser-security random ssl
2 Answers

Quoting from a this great video on network video, minute 1:18:07

Well where do you get randomness on your computer because your computer is a deterministic device?

Well it collects entropies like your mouse stroke movements, your key stroke movements and the timing of your hard disk, it tries to collect all that randomness from the universe into a pull so that it can generate random keys just for one connection [this session]. And if that randomness is broken and its happened many times in the last 30 years, then none of this works. If the adversary can figure what your randomness can be then they can guess your keys. So use good randomness.

Note: the keys are created per session.

user_51757090
Related