1

Say, an attacker wants to perform a MitM but all he has available is the network traffic between a client and a server. He has no further information about the data or certificates than what's being exchanged over the network, with him in the middle.

Both client and server have a very limited set of trusted CAs, and will validate connections against the same, both on the client and the server side. It is impossible for the attacker to obtain or by other means steal a valid private key signed by a trusted CA.

Is a MitM possible under such circumstances?

Improve this question

1 Answer 1

Reset to default
2

Since the attacker has no access to a certificate trusted by the victims nor can generate such a certificate it is impossible to mount an active man in the middle attack against TLS connection, provided that the victims properly check the certificates.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .