Hacker News new | ask | show | jobs
by tialaramex 2563 days ago
Most of that description is outdated and/or wrong. Probably this HN article should say (2015).

But yes, of course you can decrypt an encrypted hash, this way you get back the plain hash.

The client calculates a hash, it _encrypts_ that hash, and sends it to the server, the server _decrypts_ it, and then can verify that it has the same calculation.

The reason this is done is that it can detect a situation in which the client and server were persuaded to arrive at the same results by different means, whereupon they should abort the connection. The mechanism in TLS 1.2 and earlier was not very good, a better one is included in TLS 1.3 but alas last I looked it is disabled in popular browsers because it's incompatible with yet more middlebox crapware from "security" companies.