Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If a Man-in-the-middle has the private RSA key of the SSL encryption. It should be possible for the Man-in-the-middle to decode the entire HTTPS datastream right? So, then the encryption is essentially broken.

share|improve this question

closed as not a real question by Adnan, TildalWave, NULLZ, Terry Chia, AJ Henderson Jun 17 '13 at 14:16

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

    
The encryption is not "broken", thats exactly the way it is supposed to work - if you have the decryption key, you can decrypt the data. What is your actual question here? –  AviD Jun 20 '13 at 7:16

1 Answer 1

There are two relevant attacks:

  1. An active attacker impersonates the server. You can't do anything about that if you trust the attackers key. So you need to keep the server's private key private, and you have to make sure that you only trust the right keypair. Typically we use Certificate Authorities to attempt to solve the later problem.
  2. A passive attacker sniffs your connection with the legitimate server. If they know the server's private key they might be able to decrypt the SSL encrypted session. This depends on the handshake and thus on the chosen ciphersuite.

    With the weak RSA ciphersuites the server's private key has two uses: Authenticating the server and ensuring confidentiality. When an attacker learns the server's private key these connections can be decrypted without impersonating the server.

    Stronger suites use ephemeral Diffie-Hellman keys. Here the RSA key only serves to authenticate the server. Confidentiality comes from the Diffie-Hellman key-exchange with keys that are only valid for this single connection. In this case knowledge of the RSA key doesn't allow decryption of the connection. Ephemeral Diffie-Hellman provides perfect forward secrecy because when the private key leaks, past connections can't be decrypted.

share|improve this answer
    
"In theory, Transport Layer Security can choose appropriate ciphers since SSLv3, but in everyday practice many implementations have refused to offer PFS or only provide it with very low encryption grade" <-- what does this mean for our the most important ssl sites today, like the banksites? –  user27296 Jun 16 '13 at 17:09
    
@CodesInChaos I was under the impression that on the third step of the SSL handshake, the server either sends its certificate or proceeds with DH key exchange. Because DH allows for anonymous communication, does this not mean that it is also vulnerable to MITM? –  Lex Jun 17 '13 at 11:03
    
@CodesInChaos I hope I have not misinterpreted the book, but I have found out why I thought that: - Stein, Lincoln D in: "Web Security - A Step by Step Reference Guide", 1997, ISBN 0-201-63489-9, pp40-43. The author describes the 9 steps of the SSL handshake adding a comment on the DH key exchange; I quote: "[...] client and server negotiate a shared session key without ever identifying each other. Because there's no certificate exchange, the interaction is completely anonymous. This also means that the transaction is vulnerable to a man-in-the-middle attack.". p43 –  Lex Jun 17 '13 at 11:13
1  
@Lex That refers to anonymous DH suites. Anonymous suites are only secure against passive adversaries. (EC)DHE_RSA uses DH for the key-exchange and RSA for authentication. So if you validate the RSA certificate you identify the server, and thus prevent impersonation/MitM. –  CodesInChaos Jun 17 '13 at 11:52

Not the answer you're looking for? Browse other questions tagged or ask your own question.