SSL - Why using a symmetric cipher ?

Hi everybody,

I recently discovered the principles of SSL (on Wikipedia) and there is something I don't understand.

What is the point of using RSA to encrypt a keystream (usually generated by RC4) and then sending the encrypted keystream and the "keystream XOR message" whereas we could use RSA to encrypt the message itself and then we would not need to use RC4 at all ?

I think there must be an explanation but I can't find it ... any suggestion ?

Thanks

Public key encryption is expensive, CPU-wise. The longer the message, the exponentially longer it takes to encrypt. It's *way* more efficient to encrypt a short string asymmetrically, then encrypt the normal data symmetrically, than it is to encrypt the entire data stream asymmetrically.

This is common practice almost everywhere that involves public key crypto. Almost any time you see public key crypto used, it's either to a) sign a document, or b) to exchange a symmetric key.

No security loss, but all the easier on your computer. Keeps the server from needing 90% CPU for 2 minutes every time you request a new https page.

What B-con said.

And, you can only encipher as much data as the RSA key length. So if you have a 1024 bit key (128 octets) then you can only protect 128 bytes at a time. If you needed to protect say 1100 bytes, you would have to do ten RSA operations. It might takes minutes.

Ok thank you I think I understand.

Just to be sure : what is asymmetrically encrypted is only the seed which is used to generate the keystream in order to apply a XOR between this keystream and the message itself ?

Normal practice is for Alice to randomly generate a 'session key'. Its just a random block of bits. Alice then uses Bob's public RSA key, and encrypts the session key, sends it to Bob.

Then Alice uses the session key with a block or stream cipher to encipher the secret message. Alice sends the ciphertext to Bob, who uses the session key to decipher it.

Some protocols send the whole thing in one transmission, others send parts separately. Make no difference at the 30,000 foot level

What fish said.

In specific, with your RC4 example in the beginning, the session key is used to seed the RC4 PRNG which then produces the pseudo-random string used to XOR against the plaintext, if that's what you're wondering about.

Yes it is

Thank you.