Re: SSL Query

Wikipedia goes into this in-depth, so I will not repeat all of it
here. At a high-level, both the client and server in situation (2)
negotiate the cipher and key material. They exchange random numbers
and generate public-private key pair from this exchange. This results
in a session key which is temporary, unique to the connection, and
separate from the server certificate.

Regards,

J Wolfgang Goerlich


Related Links:

Wikipedia, Transport Layer Security
http://en.wikipedia.org/wiki/Transport_Layer_Security#How_it_works

Microsoft Technet, SSL/TLS in Detail
http://technet2.microsoft.com/windowsserver/en/library/2a9816ef-70bf-4bd7-a043-9ba721595e271033.mspx?mfr=true

On Sep 8, 1:38 pm, amsical <amsi...@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
Hi,

SSL can be used in the following 2 situations:
1. Where Server and Client know each other
2. Where Server and Client does not know each other e.g. secure public sites
like e-bay

In the first scenario above, Server will have Server Certificate and Client
will have Client Certificate. Server will encrypt a message using Client's
public key and Client will encrypt a message using Server's public key. Each
will use their own Private key to decrypt the same.

Now, in the second scenario above, Server will have Server Certificate but
Client will not have Client Certificate. Client can encrypt a message using
Server's public key. But how the Server will send the encrypted message in
absence of no Client Certificate? or is it that a temporary public-private
key is provided to the client?

Thanks,
Tim


.

Relevant Pages

  • [Full-disclosure] [GOATSE SECURITY] Clench: Goatses way to say "screw you" to certificate author
    ... Application layer authentication-inherent validation of public key ... Goatse Security’s new simple password-based authentication mechanism ... getting hundreds of thousands or millions of users to install a client ... client hashes locally and then sends the hash to the server. ...
    (Full-Disclosure)
  • Re: Explanation of SSH
    ... I am still unclear on how SSH works exactly. ... Client issues SSH command and names server ... "Shopper" says "server sends back its public host and server keys ... Surely there is only one public key it sends ...
    (comp.security.ssh)
  • [NT] Dark Age of Camelot Man-In-The-Middle
    ... use of RSA public key cryptography and an RC4 based symmetric algorithm. ... Seeing the imminent release of code for cracking the game client (which ... At the beginning of each TCP session, the server sends a 1536 bit RSA ... void bytes_out(unsigned char *data, int len) ...
    (Securiteam)
  • Re: Debian SSH server configuration
    ... I would like to configure a Debian server to only allow clients to ssh ... I don't want any client computers to be able to ssh into ... It sounds like what you are asking for is host based authentication, ... where the server check to make sure that it has the host public key ...
    (Debian-User)
  • Re: Basics of key authentication
    ... The public key gets copied to the server, ... and the client decrypts it with its private key to prove he is who he ... and the digital signature to the server. ...
    (comp.security.ssh)