Re: SSL without certificates

From: MS (ms_at_ms.net)
Date: 07/08/03 

Date: Mon, 07 Jul 2003 18:15:25 -0400

Terry wrote:
> Quote: mccarthur@btinternet.com wrote that the client needs the server's
> cert
> because the client uses the public key from the cert to encrypt the data
> sent to the server. That is not correct. The data sent back and forth
> along the SSL connection are encrypted using a symmetric (secret) key,
> not a public key. The secret key is created during the SSL handshake.
>
> As far as I know, in a SSL connection, the server's cert sent to client is
> used to encrypt the session key(secret symmetric key) generated on the
> client side which is then sent to the server for use in the connection. So
> if the you dont use a server's cert, how can this be done?
>

The TLS standard allows "anonymous" key exchange. That is, the symmetric
key is generated without a priori authentication of the two parties. For
example, the Diffie-Hellman protocol can be used for that --- in
essence, each party creates a piece of the key, they exchange the two
pieces, and put them together to form the common secret key. And it's
done in such a way that an eavesdropper cannot recreate the key.

MS

Relevant Pages

  • RE: Cannot decrypt files encrypted using Crypto API on a different
    ... On the client computer you app first would try to open the container ... the server generates session key, wraps it with the client's public key, ... encrypts the content with the session key and sends both the wrapped session ... encrypt your data with this key ...
    (microsoft.public.platformsdk.security)
  • Re: SSL without certificates
    ... mccarthur@btinternet.com wrote that the client needs the server's ... because the client uses the public key from the cert to encrypt the data ... The secret key is created during the SSL handshake. ...
    (alt.computer.security)
  • RE: Cannot decrypt files encrypted using Crypto API on a different
    ... but what is the point to encrypt the data if ANYBODY can decrypt it (since ... the server just sends something to somebody or first the client contacts the ... supposed to somehow encrypt the file and distribute it to the clients. ... the server generates session key, wraps it with the client's public key, ...
    (microsoft.public.platformsdk.security)
  • RE: Cannot decrypt files encrypted using Crypto API on a different
    ... supposed to somehow encrypt the file and distribute it to the clients. ... On the client computer you app first would try to open the container ... the server generates session key, wraps it with the client's public key, ... encrypts the content with the session key and sends both the wrapped session ...
    (microsoft.public.platformsdk.security)
  • Re: OE Encryption
    ... It will include identification of your cert. ... It will also include your public key which will be needed by anyone who wants to send you an encrypted message. ... They use your public key to encrypt their message and you use your private key to decrypt it. ...
    (microsoft.public.windows.inetexplorer.ie6_outlookexpress)