HTTPS uses Asymmetric or Symmetric encryption?

Question

I have searched all this morning but I've found websites where it is said that data is sent through an asymmetric encryption using the TLS protocol Then I found the contrary Please can you tell me which is true? Thanks And does anyone know a guide where it is explained step by step the handshake of tls protocol over https?

Zelaya

Both. Asymmetric is slow (relatively speaking), so it is used to encrypt symmetric encryption keys that are used to encrypt the actual data. – Accelerando

By "data" do you mean application layer payload? – Heelandtoe

Answer 1

The best answer is that it does both. TLS uses asymmetric encryption to first establish the identity of one or both parties. Secondly, it uses asymmetric encryption to exchange a key to a symmetric cipher. So asymmetric is only used during the initial setup of communication.

Symmetric encryption which is used through the rest is faster and more efficient with large amounts of data transfer. The keys are smaller which is generally why it's faster, but its algorithm is also easier to process.

As far as a guide goes, a simple Google search will give you plenty. The one I found from IBM looks decent. They removed some of the excess detail to make it easier to understand.

Burdine

It is possible within the SSL and TLS spec that no encryption is used. In this case it would only be used for identity verification which is optional based on the client implementation. – Burdine

"So asymmetric is only used during the initial setup of communication" - to be more precise - it's going to be used for signing, not for encryption: https://mcmap.net/q/666657/-does-https-use-asymmetric-or-symmetric-encryption – Codfish