TLS from Scratch — Key Exchange and Certificates

Behind the padlock icon, your browser pulls off something strange: it agrees on a secret with a stranger, over a wire everyone can read. This walks through key exchange, certificates, and the TLS 1.3 handshake from zero, ending with why a man in the middle cannot win.

Making a secret with a stranger, on a wire everyone can read

Internet traffic is closer to a postcard than a sealed envelope. Your packets pass through your home router, the café's Wi-Fi access point, your ISP's equipment, relay gear on the far side of an ocean, and finally the edge of someone else's data centre. If anybody along that path reads the contents — or rewrites them — plain traffic gives you no way to notice.

TLS (Transport Layer Security) is what makes a private conversation possible on top of that postcard. It is the "S" in HTTPS, and the thing the padlock in your address bar refers to.

TLS promises three things:

• Confidentiality: nobody on the path can read the contents
• Integrity: if even one bit is altered, the receiver detects it
• Identity: the party you are talking to really does own example.com

The third one is the hard part. The first two fall out of the standard cryptographic toolbox — symmetric keys, public keys, hashes, covered in Cryptography from Scratch. But "is this really them?" is not something arithmetic alone can settle. That question is the second half of this article.

Sharing a secret without sending it

Start with confidentiality. To encrypt anything, sender and receiver need the same key. But if you put the key on the wire, the eavesdropper gets it too. That is the first contradiction.

Paint makes the way out visible. You and the other party first agree on a shared colour that anyone may see. Each of you then mixes in a private colour of your own and sends the mixture across. When you stir your private colour into the mixture you received, both of you end up holding the same colour: shared plus yours plus theirs. The eavesdropper saw the shared colour and two mixtures, and cannot separate a mixture back into its parts. The whole trick rests on an asymmetry: mixing is easy, unmixing is hard.

Diffie-Hellman key exchange is that idea done with numbers. Fix a large public prime $p$ and a base $g$; each side picks a private number, $a$ and $b$.

In words: raise the base to your own private number, and send the remainder after dividing by $p$. That $\bmod p$ — taking the remainder — is what makes the original number hard to recover from the result.

In words: apply your private number once more to whatever the other side sent, and you both land on the same $g^{ab}$. That $s$ is the shared secret. Only $g$, $p$, $A$ and $B$ ever crossed the wire; $a$, $b$ and $s$ never did.

Recovering $a$ from $A$ is the discrete logarithm problem, and as the key grows the work required climbs into orders of magnitude that nobody can pay. Not "impossible" — "not worth the time." Cryptographic security always has that shape.

Why it switches to a symmetric key immediately

Once the key exchange has produced a shared secret, everything after that is encrypted with a symmetric key derived from it. Public-key arithmetic is orders of magnitude heavier, and it is the wrong tool for pushing video or API responses through.

So TLS splits the roles: public-key machinery only during the handshake, symmetric encryption for the payload. That hybrid structure is the skeleton of the protocol.

What the E stands for — forward secrecy

Modern TLS uses ECDHE: Diffie-Hellman on an elliptic curve. The trailing E is for ephemeral, meaning fresh $a$ and $b$ for every connection, thrown away when the handshake ends.

The payoff is in the future. Older TLS offered a mode where the client picked the symmetric key, encrypted it with the server's public key, and sent it (RSA key exchange). Under that scheme, if the server's private key leaks years later, an attacker who archived the old traffic can decrypt all of it at once. There was only ever one key.

With ephemeral keys, there is no long-lived key left to leak. That property is called forward secrecy. TLS 1.3 (RFC 8446) removed static RSA key exchange from the specification entirely and restricted key exchange to (EC)DHE — a deliberate decision to leave no bad option available.