1
vote
1answer
109 views

SSL Handshake random number?

I realized all of the phase of the handshake but I do not understand how it does that from the two randomly generated numbers are unable to generate a session key that the client and the server uses ...
0
votes
1answer
129 views

Can the random keys generated during handshake be guessed

During the handshaking of an SSL connection, the server sends its public key, the client generates a random password, encrypts it with the pk, and sends it back, then the server decrypts it and all is ...
5
votes
1answer
528 views

Should I include a random padding in every HTTPS request and response?

According to the following paper, it is possible to decrypt HTTPS traffic by inspecting AJAX calls and using the size parameter as a cryptographic oracle. Should I be sending a variable length ...
4
votes
1answer
248 views

Random number for HTTPS Message Authentication Code (MAC)

Recently I found that Netscape used quite simple algorithm to generate random number for Message Authentication Code to establish an HTTPS connection (Netscape used time, process identification ...