What is true about a TLS handshake?

What is true about a TLS handshake?

• A. Key exchange and certificate validation occur during TLS handshake to establish a secure session
• B. It uses only symmetric encryption
• C. It occurs after the data transfer
• D. No certificates are involved

Answer: (A)

The TLS handshake is about authenticating the endpoints and setting up the cryptographic parameters for the session before any data is sent. During the handshake, the server presents a certificate (and possibly the client), and the client validates that certificate chain to confirm the server’s identity. At the same time, the parties perform a key exchange using asymmetric cryptography to establish a shared secret, from which symmetric session keys are derived for encrypting the actual data. This combination—certificate validation to establish trust and a key exchange to create the session keys—happens upfront, so the secure session is ready before any application data travels. It isn’t solely symmetric encryption, and it isn’t performed after data transfer. certificates are indeed involved, which makes the described statement correct.

The TLS handshake is about authenticating the endpoints and setting up the cryptographic parameters for the session before any data is sent. During the handshake, the server presents a certificate (and possibly the client), and the client validates that certificate chain to confirm the server’s identity. At the same time, the parties perform a key exchange using asymmetric cryptography to establish a shared secret, from which symmetric session keys are derived for encrypting the actual data.

This combination—certificate validation to establish trust and a key exchange to create the session keys—happens upfront, so the secure session is ready before any application data travels. It isn’t solely symmetric encryption, and it isn’t performed after data transfer. certificates are indeed involved, which makes the described statement correct.