Transport Layer Security (TLS), Public & Private Keys
Tags: security
Published: 2023-03-05 19:08:59

Assume you own a bank and you want to send a users name and password to the server.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dooi1zl4b9dkil7ajn7i.png)

But while passing the data, a hacker can easily hack that data.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/61sp1ojx2cgdsm0jbprm.png)
To solve this, you can use an encrypt and decrypt key. Now your data will be encrypted.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/06bmka4xi959zx1020vv.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/k2eksrx9rwn1esau5n43.png)

Now the hacker gets the data but it's encrypted.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/iyb6w00ow3xtcqdt1o5w.png)

But you have to sent the key to the server so that the server can decrypt as well.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/h8e5xmlukslx41tjdfwj.png)
Now the hacker will get the key and hack your data.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1oohpzmldx4zuiftdwar.png)
This is called Symmetric encryption.

**Asymmetric encryption**

To prevent the issues in symmetric encryption, we use private and public key.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/upjpiybn73c8uj7zvc94.png)

Assuming public lock for our better understanding in this blog.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gn7zndz9rf3xeinozfrf.png)

Here your data is encrypted using public lock and you can encrypt the data only using the private key.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/l4rnsuowua92mns97a9u.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cw8c1ag8afa1qse6ozhs.png)

You can generate this key using this way.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1k6v5av77rbf08dsudht.png)
You can use this public lock and anyone can access it but can not break or open it.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/j38xyuf9wa8m7ebzp4gd.png)
But you can access the server 1 using your private key.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gf4rc09ogrr7mtpys650.png)
Now the server sets 2 keys. Public and private key and send the public key or lock to you.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/m6jlfd02jzw1ctv3e6pd.png)
The hacker gets one too.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o4qe0msmte3ccuao90uw.png)

Now you add the encryption key to this packet.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ruq8v523bzja0uz3joqt.png)
You then send this packet to the server.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/e2c69r8j8g9imouvylg2.png)
Now the server can easily unlock its public lock which it sent previously.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/or1qbnuj7b8y34qiv7lf.png)
This time hacker can not access to the package as it does not have server's private key.

Now the server has successfully got the encrypted key.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/izr3ww1nfv0icjbc33yo.png)

Now assume that the hacker is acting like a server .

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4lurzdo2ofvnhy0h0w61.png)
Now you were confused and sent your encrypted key and data to the hacking server.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/i9z8t6yeig4i2c0sdyp0.png)
So, you have been hacked now as the hacker has all the data.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fkgf7jq01dpvx1516fiq.png)

But we have a solution here.
When any server send any package it sends a certificate as well to prove that the server is real.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pg3hvs3yf290vpkeovp5.png)

This is how it might look.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/op7hquzntf7snj4touuj.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7ewyabl5v5qciyd3ubeg.png)
But the hacker can also create a certificate of its own.
But how to know that?
You  can see the certificate is signed by himself

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/l56xtti6x2nfj3r4mf2k.png)

But this should not be here.
Even browsers show you issues when they see "self" in the signature row.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/v0kugemxp5tcrn1pjhiq.png)

So, here comes Certificate Authority(CA) which will ensure the real certificate.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/v5414qu0mu3zc61l3w1t.png)
Once issues, you can see this.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rx14h3trvqg06m872njb.png)

Basically our browser has access to CAs and get recognize it.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gkhvk31mk6cwijbd2o3r.png)

This is how our browsers have recorded all of the CAs.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gn7i8to7k4xemdvzszra.png)

Lets clear the public lock and key confusion.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/isrgdofeg97jdyx4jktp.png)
As mentioned, this is actually a public key not a public lock.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/x0l6y1on7o85taxfr61s.png)

You can encrypt your data with one key and decrypt with other.
So, if you encrypt using private key, hacker and other can easily access public key and thus can hack your data.

So, you should encrypt your data using public key and you can then decrypt data only using the private key which is not available to the hackers.
Also , they are meant using these extensions.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8hionkax35re2ryhz871.png)



Done!
<img src="https://media.giphy.com/media/26ufdipQqU2lhNA4g/giphy.gif">