The following diagram illustrates a symmetric cipher:
In the preceding diagram, the plaintext Hello! is encrypted using a symmetric cipher. A secret key is used with the cipher to produce a ciphertext. This ciphertext can then be transmitted over an insecure channel, and eavesdroppers cannot decipher it without knowledge of the secret key. The privileged receiver of the ciphertext uses the decryption algorithm and secret key to convert it back into plaintext.
Some symmetric ciphers in general use (not just for TLS) are the following:
- American Encryption Standard (AES), also known as Rijndael
- Camellia
- Data Encryption Standard (DES)
- Triple DES
- International Data Encryption Algorithm (IDEA)
- QUAD
- RC4
- Salsa20, Chacha20
- Tiny Encryption Algorithm (TEA)
One issue with symmetric encryption is that the same key must be known to both the sender and receiver. Generating and transmitting this key securely poses a problem. How can the key be sent between parties if they don't already have a secure communication channel? If they do already have a secure communication channel, why is encryption needed in the first place?
Key exchange algorithms attempt to address these problems. Key exchange algorithms work by allowing both communicating parties to generate the same secret key. In general, the parties first agree on a public, non-secret key. Then, each party generates its own secret key and combines it with the public key. These combined keys are exchanged. Each party then adds its own secret to the combined keys to arrive at a combined, secret key. This combined, secret key is then known to both parties, but not derivable by an eavesdropper.
The most common key exchange algorithm in use today is the Diffie-Hellman key exchange algorithm.
While key exchange algorithms are resistant against eavesdroppers, they are not resilient to interception. In the case of interception, an attacker could stand in the middle of a key exchange, while posing as each corresponding party. This is called a man-in-the-middle attack.
Asymmetric ciphers can be used to address some of these problems.