SSL Certificate encryption vs cypher encryption

Question

I just installed a SSL certificate. This certificate is encrypted with 2048 bit encryption.

However, the cypher is 128 bit encryption(or 40, or some other variation depending on the browser.)

It seems that there are two different types of encryption here. The "handshake" encryption of 2048 and the "over the wire" encryption of some magnitude smaller.

Do I have this right in theory? Can anyone explain it better?

I have been all over the Google and cannot find a clear explanation of the difference between the two.

Thanks in advance

Answer 1

It is true that symmetric encryption typically uses much fewer bits for its key length. The reason is because symmetric encryption is much stronger at a given number of bits.

Asymmetric encryption (where each side has a different key) is much harder to pull off. It is more computationally intensive and therefore only used for the handshake portion or for encrypting a symmetric key that the rest of the message uses.

Answer 2

There is a good entry in Wikipedia.

You are right, there are two kinds of encryption going on. The first one is asymmetric encryption or public key encryption - this is the one with the larger key. The second type is symmetric encryption with the smaller key.

The first type of encryption (asymmetric - larger key) is used to negotiate what type of symmetric encryption the client and the server will use. They'll also exchange the session key that they'll use. This is the handshake process and this is encrpyted using the asymmetric encryption

The session key is basically the key that they'll use when sending the real data, encrypted by whatever type they've decided on the handshake process. This is the symmetric encryption part.

Answer 3

Thank you both for the replies. I can see how this works now.

The thing I am missing is what type of attack could be launched against the certificate itself.

If the server generates a session key that is then encrypted symmetrically, compromising the server certificate will not compromise they data because you still will not have the session key?