MicroNugget: What are SSL Session Keys?

[@intodeep28]

In under 5 minutes, you managed to do what the internet failed to do for me over several hours... well done!!

[@dambhir]

SSL is broken - down to its simplest form... Best explanation ever hands - down

[@ullasrajdev2342]

4 minute he explained my days of doubts and insane exhibits and explanations... Ideal tutor by all means

[@ThiliRocks]

Love Keith. Always simple and concise explanations. He is best!

[@cbtnuggets]

We're glad you enjoyed this video, Thilina! Thank you for learning with us.

[@cbtnuggets]

if you click on the little 'cc' button in the player controls bar you can turn on closed captioning for English subtitles.

[@Facebookmovies12345]

The is the best overview of ssl I've ever seen.

[@ullasrajdev2342]

He is the one.. the marvelous explanation in nutshell. The best about SSL I have ever seen

[@JamesLee-Im-All-In]

Crispest explanation of what a session key is!

[@nasirmukhtar3796]

Thanks Keith/CBT Nuggets, quick & charismatic as always! 👍

[@goddessofwar94]

What a wonderful, concise explanation! Thank you!

[@justheredoingnothing1170]

Thank you so much! I finally understand the concept now. The explanation was very clear.

[@anumsheraz4625]

best video ever. Thank you for explaining a complex topic in an easy way !

[@81funktion]

Hi Keith. Is there a CBT series that covers SSL in depth?

[@greg3626]

Hi Thanks for the explanattion. Just a question. Once the client/server decide on the session key, are the subsequent messages then only encrypted with the session key or with both the session key and the public/private keys ?

[@anumsheraz4625]

@2:30 to encrypt data in other direction (from client to server), can't we validate the client in the same way as we validated the server ? e.g. by generating client public key as well ?

[@aafre]

Best tutorial out there.

[@simpleguy2k]

so niece keith... it sets me free!

[@anilkommalapati6248]

very useful ssl session. thank u very much.

[@niketrami5827]

Hey Keith, thanks for this great video. I have a question if you can helpme with. When server sends a certificate signed digitally so how client will check that certificate is genuine. In other words when digitally signature are decrypted with the key from intermediate or root certificate, where do we compare that decrypted signature value to consider the certificate as authentic.

[@SandeepPatil-fp7ud]

So basically client would refer to root certs that it has pre-installed to validate the certificates or the chain of certs for that matter however when it comes signature it’s it hets bit tricky, What client does is take that Cert info in clear text and hash it all and then referred the root ca from its repository and decrypt the hashed info using that private key and if that matches it proves that the received Cert is validated by CA

[@rahuld.4734]

3:32 How can acme.com decrypt the session key sent by the client using the private key ? The session key was encrypted using public key by the client. That means only public key should be able to decrypt it at the server. Am I missing anything ?

[@karpedjem6958]

Whatever is encrypted with Acme’s public key by a third party can only be decrypted with Acme’s private key. This private key never leaves acme, must be kept strictly secret and is therefore never distributed. When acme receives the session key generated by the client and encrypted with acme public key, acme decrypts it and changes from asymetric algorithm to symetric algorithm to start communicating in both directions with the client.

[@ajay2552]

@@karpedjem6958 hey! I have a doubt if you could help!! What's stopping a middle man attacker to act as the client? Like it could receive pubic key of acne.com, and generate its own session key, encrypt the session key with acne.com's public key and send it to the website.. now the website will encrypt data using session key which was generated by middle man and so the middle man can see all the data..

[@lalanomama7035]

it's seem very veeety easy when you explain it .... thank you

[@darylallen2485]

Pretty good Keith. I'm disappointed that you did not explicitly mention that the web server client generates the session key. I suppose its implied, but I think its worth stating that the client does generate the session key.

[@EvilSapphireR]

Not always. In DH or ECDHE key exchange methods both parties generate their own set of parameters and do individual calculations on both of them to come up with the same session key.

[@crissstim]

Nice explanation. Thanks.

[@taftazani6400]

hmm, why not use a key exchange like DH?

[@EvilSapphireR]

Depends on the cipher suite.

[@TheKietTran]

Great explanation. Thanks.

[@spd8335]

SSL GOOD Explationation

[@zrh1618]

perfect! thanks!!!

[@newkool100]

good one

[@AzikoX]

could you add text subtitles..

[@asaurcefulofsecrets]

doesn't cover forward secrecy

[@ishanmodi3626]

Its just an OverView.. JUST A very basic overVIEW..