Diffie-Hellman Key Exchange

I recommend beginning at the fundamentals. For example here's a video that walks through Diffie Hellman, so that anybody can follow, you can probably sprint through it, but by taking it slow they avoid accidentally forgetting anything important. ▶ this video Grasping the fundamentals means that when it comes to policy decisions (e.g. in the management of certificates) you can see what the consequences of a particular decision are, rather than just hoping that whoever proposed that policy knew what they were doing. For example, I think a lot of people today use Certificate Signing Request (CSR) files without understanding them at all. But once you have a grounding in the underlying elements you can see at once what the CSR does, and why it's necessary without needing to have that spelled out separately. Or another example, understanding what was and was not risky as a result of the known weakness of SHA-1. I saw a lot of scare-mongering by security people who saw the SHA-1 weakness as somehow meaning impossible things were now likely, but it only affected an important but quite narrow type of usage, people who understood that could make better, more careful decisions without putting anybody at risk.

in “Ask HN: Want to study SSL, HTTPS, and the works. Where to start?” · View on HN

As others have already pointed out, this explanation focuses on the RSA key exchange, which has been deprecated. It's not recommended for use with the current line of protocols (TLS 1.2 and earlier) and it's been completely removed from TLS 1.3 (work in progress, but close to being finished). The key weakness of the RSA key exchange is that session encryption keys are transported over the network encrypted with the server's public key. When the server's private key is compromised in some way, the attacker can passively decrypt all traffic, they can also "go back in time" to decrypt all previous conversations they might have recorded and kept. For a more secure handshake approach, consider the Diffie-Hellman key exchange, which is a way for two parties to agree on a secret number (a very large number when used for encryption, of course) that third party can't discover from looking at the network traffic. It's a very simple and intuitive algorithm; there's a great video that explains it here: ▶ this video Today, we generally use the ephemeral elliptic curve DH variant (ECDHE), which has better security characteristics and works much faster. However, DH is not sufficient, you must also authenticate the other party. Otherwise you could be negotiating your key exchange with the attacker and not the real recipient. This is where public cryptography comes in. After the key exchange, both parties use their private keys to sign the transcripts of the entire conversation up until that point

in “How HTTPS Handshake Happens” · View on HN

This is a great pair of videos that intuitively explain Diffie-Helman key exchange and then the RSA algorithm in a way that requires no previous knowledge of cryptography: "Public key cryptography - Diffie-Hellman Key Exchange" ▶ this video "Public Key Cryptography: RSA Encryption Algorithm" [link] Good coverage of the fundamentals before attempting a deeper understanding of PGP specifically.

in “Ask HN: Is there a “ground-up” explanation of PGP/GnuPG?” · View on HN

Reminds me of a video[0] that describes Diffie-Hellman key exchange in terms of mixing color values (as globs of oil paint). I guess in this game you're guessing the mix of primary colors, so maybe it doesn't hold the same property of difficulty in deriving the constituents? [0] ▶ this video

in “Guess my RGB” · View on HN

When reading the title, this came to mind: ▶ this video (Diffie-Hellman key exchange explained using paint). There is also this one by Computerphile: [link]

in “Secret Colors: A Gentle Introduction to Cryptography” · View on HN