Yes, that's essentially correct.
If the directory is in an ssl-protected place, then the challenge/response (ie, the user/pass sent over the network) will be encased within the cryptographic sleeve.
It goes something like this:
- browser makes an https request (ie, tries to access an https/ssl webpage)
- webserver responds with server certificate and encryption keys (public key)
- browser examines (sometimes with user intervention) the certificate, and accepts the session key
- a secure connection (cryptographic sleeve) is created; all traffic between the client/browser and server is encrypted
- if the .htaccess is set to require http basic auth, the basic auth challenge is presented (ie, user/pass dialog appears)
- user/pass is passed to server, inside SSL crypto sleeve
- if valid, server returns contents of requested location, also protected by SSL
and so forth ad nauseum...