Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
Isn’t it possible to simply capture the key while it’s being negotiated between machines?
Let’s say I connect to my bank’s website. Browser will send request to bank server. Bank server will send me copy of its SSL certificate. If it’s valid, browser will send signed ack. Isn’t it possible to simply capture private key at that time?
Your private key (and bank’s too) is never sent over the network. The bank’s public key is a part of the X509 certificate that it sends to your browser. If banks signs anything it does it using its private key, and your browser verifies the signature using the bank’s public key (from the certificate). The whole SSL session is encrypted using symmetric cipher (for performance reasons). To be able to do that both parties need to exchange the session key (different for each connection and renegotiated after defined interval of time). This exchange is done using Diffie-Hellman algorithm. During this exchange the key is not sent over the network, it is computed independently by both parties.