Skip to main content
Information Security

Return to Answer

added 11 characters in body
Source Link
David Schwartz
David Schwartz
  • 4.3k
  • 26
  • 21

The short answer is "no". The longer answer is that SSL is specifically designed to make this impossible. If this was possible, SSL would be useless for its primary intended purpose -- to secure things like credit card numbers sent to secure web sites.

The short (and technically incorrect) answer for how SSL does this is as follows:

  1. The server presents a certificate to the client.

  2. The client confirms that the certificate was signed by an organization the client trusts and that thethis organization certifies that the organization iscertificate belongs to the oneserver the client wants to reach.

  3. The client generates a random key, encrypts it with the public key in the certificate, and sends it to the server.

  4. The server decrypts the key and uses the shared secret the server and client now have to secure further communications. (It does this in a somewhat complex way though. Again, this is an oversimplified explanation.)

Decrypting the data would require at least recovering the shared secret generated at step 3. But how would you do that? It was only sent over the wire encrypted, and you don't have the server's private key.

The short answer is "no". The longer answer is that SSL is specifically designed to make this impossible. If this was possible, SSL would be useless for its primary intended purpose -- to secure things like credit card numbers sent to secure web sites.

The short (and technically incorrect) answer for how SSL does this is as follows:

  1. The server presents a certificate to the client.

  2. The client confirms that the certificate was signed by an organization the client trusts and that the organization certifies that the organization is the one the client wants to reach.

  3. The client generates a random key, encrypts it with the public key in the certificate, and sends it to the server.

  4. The server decrypts the key and uses the shared secret the server and client now have to secure further communications.

Decrypting the data would require at least recovering the shared secret generated at step 3. But how would you do that? It was only sent over the wire encrypted, and you don't have the server's private key.

The short answer is "no". The longer answer is that SSL is specifically designed to make this impossible. If this was possible, SSL would be useless for its primary intended purpose -- to secure things like credit card numbers sent to secure web sites.

The short (and technically incorrect) answer for how SSL does this is as follows:

  1. The server presents a certificate to the client.

  2. The client confirms that the certificate was signed by an organization the client trusts and that this organization certifies that the certificate belongs to the server the client wants to reach.

  3. The client generates a random key, encrypts it with the public key in the certificate, and sends it to the server.

  4. The server decrypts the key and uses the shared secret the server and client now have to secure further communications. (It does this in a somewhat complex way though. Again, this is an oversimplified explanation.)

Decrypting the data would require at least recovering the shared secret generated at step 3. But how would you do that? It was only sent over the wire encrypted, and you don't have the server's private key.

Source Link
David Schwartz
David Schwartz
  • 4.3k
  • 26
  • 21

The short answer is "no". The longer answer is that SSL is specifically designed to make this impossible. If this was possible, SSL would be useless for its primary intended purpose -- to secure things like credit card numbers sent to secure web sites.

The short (and technically incorrect) answer for how SSL does this is as follows:

  1. The server presents a certificate to the client.

  2. The client confirms that the certificate was signed by an organization the client trusts and that the organization certifies that the organization is the one the client wants to reach.

  3. The client generates a random key, encrypts it with the public key in the certificate, and sends it to the server.

  4. The server decrypts the key and uses the shared secret the server and client now have to secure further communications.

Decrypting the data would require at least recovering the shared secret generated at step 3. But how would you do that? It was only sent over the wire encrypted, and you don't have the server's private key.