Comments (4)
yl-yue
commented on May 17, 2024
密钥交换加解密是TLS协议的动态实现，HTTPS的证书是静态的，而使用密钥交换加解密，全局过程中的密钥都是随机的。
步骤2.1的作用正是为了在传输过程中，不泄露最终交换的密钥
from yue-library.
yl-yue
commented on May 17, 2024
是的，复杂了。可以简化流程，感谢你的指出。我梳理了多一个交换步骤，能隐藏客户端公钥和增大劫持成本，但意义不大。后续我考虑优化下，简化流程降低使用成本。
至于当初这样设计的意义，我理不清了，应该就是设计缺陷，搞复杂了，也可能是受SSL/TLS协议影响，应用层是做不到防劫持的。
from yue-library.
yl-yue
commented on May 17, 2024
优化后流程：
- 客户端获得对称密钥，请求参数：密钥存储key、密钥交换类型、客户端非对称加密公钥
- 服务端生成对称密钥，并使用客户端非对称公钥加密，响应加密报文
- 客户端私有解密，获得对称密钥
from yue-library.
commented on May 17, 2024
感谢回复
from yue-library.
Related Issues (2)
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from yue-library.