Every client is assigned a unique RSA key which handles the initial handshake. From there AES information is passed and decrypted by the server, all future packets, files and frames are encrypted. You can also enable WSS by installing your own certificate. Authentication is based on your local or domain account