TLS: Putting the Pieces Together · seed 1 · A4, ink-friendly. The answer key prints on its own page for grown-ups.

The handshake in order

Computing · Networks & Security · ages 21-22
Name ______________________   Date ____________

  1. What carries the traffic after the secret is agreed?

    • Plain text for speed
    • A fast symmetric cipher
    • A postcard with no envelope at all

  2. In the full TLS1.3 certificate-based handshake, what opens it?

    • The client sends hello with a key share
    • The server shows its certificate and public key
    • Both sides delete their keys at once

  3. A name mismatch still allows authenticated application data to flow.

    Circle one:   True   False

  4. What does the certificate step establish?

    • The key belongs to the name
    • That the site loads quickly today
    • That prices are low

  5. Certificate says mail, you asked for bank. Which step fails?

    • The final logout button at the end
    • The certificate name check
    • The choice of fonts on the page

  6. What does the key exchange establish?

    • A fresh secret nobody else holds
    • A new domain name
    • A longer certificate expiry period

  7. A laptop clock reads three years ahead. Which errors fit good sites?

    • Faster downloads than ever before
    • Free extra storage
    • Good certificates fail validity

  8. A server long-term signing key leaks a year after completed visits. Which visits stay sealed?

    • None at all; everything reopens years later
    • Visits with deleted ephemeral secrets
    • Only the homepage text itself
LightMySky · lightmysky.comW1-mt_JzIwi-BYG0-s1

Answer key

For grown-ups. Fold this page away before handing over the rest.

The handshake in order W1-mt_JzIwi-BYG0-s1

  1. A fast symmetric cipher · The shared secret feeds a fast cipher that guards secrecy and integrity.
  2. The client sends hello with a key share · Hello and key shares come first; certificates authenticate next.
  3. False · Authentication fails at the name check, so no authenticated application data flows.
  4. The key belongs to the name · The ID card binds the public key to the name you typed.
  5. The certificate name check · The ID check fails early on purpose, so no authenticated application data follows.
  6. A fresh secret nobody else holds · Both sides leave the exchange holding a secret no watcher shares.
  7. Good certificates fail validity · A skewed clock judges good dates as expired or not yet valid.
  8. Visits with deleted ephemeral secrets · Only visits whose ephemeral private secrets and session keys were deleted stay sealed; the leaked signing key cannot rebuild them.
Worksheet · LightMySky