Re: SSL security with server certificate compromised

MC wrote:
Additional note: with a compromised server certificate, you have an authentication problem only. A different site can successfully identify itself as the original owner. It does not mean the encryption is at risk to be sniffed out as that is still done against the client's keys.

That's not the way I read the standard (http://developer.mozilla.org/en/docs/Introduction_to_SSL). The client creates a premaster session key for encryption and encrypts this key using the server's public key. The server decrypts the the premaster session key with his private key. Then both the client and server use the premaster key to generate the same list of session keys. So if you have the server's private key then you can decrypt the premaster and create all the session keys for the session. With that you can decrypt the session just as fast as it occurred on the wire.

The client's and the server's public/private keys are only used to authenticate and do key exchange. The session encryption uses the agreed upon symmetric encryption algorithm.

dMn
.

Relevant Pages

  • A Paranoid Encryption Mode
    ... header field sent in the clear, ... the random session key being used to leak key bits by tampering. ... OAEP and the various attempts at integrity-aware encryption modes. ... maximum-period shift register in Galois configuration that is stepped ...
    (sci.crypt)
  • Re: encrypt password for webservices
    ... of a Web client and a Web server. ... decrypt them, because the Web server will use a different session key, i.e. ... >> For storage, do not use encryption, use hashing instead. ...
    (microsoft.public.dotnet.security)
  • Re: CAPI and RC4: can not decrypt when Final parameter is set to F
    ... Generate a random session key (which is gonna be used for the RC4 ... If i don't do step 3) and use the same HCRYPTKEY handle for both encryption ... the second to do the decryption, ... The client application generates a random key pair (using the .NET ...
    (microsoft.public.platformsdk.security)
  • (newbie) rsa ciphertext and plaintext
    ... in pgp, when the session key is encrypted to the public rsa key, ... (plausible enough to prefer encryption) ... can the ciphertext of the message encrypted to Charlie's key be analyzed to ...
    (sci.crypt)
  • Re: OpenVPN keys
    ... >> When I set up OpenVPN, I generated a 2048 bit static key. ... If there's a session key, ... My understanding of encryption, using ... > OpenVPN supports the use of any of the ciphers provided by OpenSSL, ...
    (comp.os.linux.networking)