In this blog post, we’ll explore the basic principles of TLS—which securely protects information exchanged over the Internet—as well as symmetric-key and asymmetric-key encryption methods, and the process by which TLS communication takes place.
We are truly in the age of smartphones. The number of smartphone users in South Korea once exceeded 39 million, and it is said that more than 50% of these users rely on their smartphones to access the internet anytime, anywhere. Given these figures, it would be no exaggeration to say that South Korean citizens can now freely access the internet anytime, anywhere. Consequently, security threats are also growing steadily. When we casually log into Naver, are the usernames and passwords we send, as well as the important information we enter when shopping online—such as credit card numbers, PINs, and CVCs—actually transmitted securely? If so, what principles ensure this security? One of the primary methods used for this is a security technology called SSL (Secure Sockets Layer) or TLS (Transport Layer Security). You’ve probably seen websites where the address starts with https://가 instead of http://; these sites use TLS to exchange information over the web.
TLS (which we’ll refer to as TLS from here on out) is a security protocol that evolved from SSL. It uses methods such as symmetric-key encryption and asymmetric-key encryption to encrypt the information being transmitted and ensure secure communication. So, what exactly are symmetric-key encryption and asymmetric-key encryption?
Symmetric-key encryption can be explained using the analogy of a key and a lock. You place a letter you need to send inside a box and lock it with a lock. If you have the key that fits that lock, you can open it and read the contents of the letter. The recipient writes a reply, locks the box using the same key, and sends it back. Here, the symmetric key corresponds to the key.
However, this method has a problem. To ensure the recipient can open the lock, the key must be sent to the other party at least once. But what if someone copies the key during that process? They could use the copied key to eavesdrop on the letters being exchanged. How can this problem be solved?
Asymmetric-key encryption solves this problem by using two keys. These keys are called the private key (or secret key) and the public key, respectively. A special type of lock is also required. This lock can be locked using the public key, and once locked, it can only be opened with the private key.
The sender sends their public key to the recipient. The recipient then writes a letter, uses the received public key to lock the special lock, and sends the letter. Even if a malicious person copies the public key, it is impossible for them to open the box. This is because a lock secured with a public key can only be opened with the private key, which has never been shared.
So, it would seem that if both parties generate their own private and public keys, exchange only their public keys, and then always use this special lock to exchange information, they could achieve secure communication. However, TLS does not work that way. This is because it takes a long time to lock and unlock this special lock. Therefore, this method is used during the process of exchanging the keys to be used for symmetric encryption, and thereafter, symmetric encryption communication takes place using the exchanged keys.
Let’s take a look at how a TLS connection is actually established. First, let’s call the party seeking to use the service the “client,” and the service provider the “server.” When the client requests a TLS connection from the server, it sends the server information such as the encryption methods available to the client. The server then informs the client of the encryption methods it supports and subsequently sends its public key. Upon receiving the public key, the client generates an appropriate symmetric key, encrypts it using the public key received from the server, and sends it to the server. This initial connection process is called a “handshake,” and once the handshake is complete, both parties can communicate securely using the symmetric key they share.
As such, TLS communication is a leading web security method that ensures security while also taking communication speed into account. However, TLS is not a panacea. Even if security is ensured during the transmission of information, if malware intercepts data entered via the keyboard while the user is inputting information, TLS cannot prevent this. Ultimately, the most important thing is to maintain personal security awareness and make efforts to protect one’s personal information, such as by refraining from installing suspicious programs.
