2

Given a conversation is occurring using HTTPS, during the handshake, can the man in the middle interpret all communication from the server to the client?

Assuming that the man in the middle can receive the packet, and open it (using the public key), could it then pass the unmodified (encrypted) packet which it received from the server? It would receive back a packet encrypted using the public key (which it would not be able to interpret), but would this allow the man in the middle to eavesdrop half the conversation?

  • Assuming that the man in the middle can receive the parcel, and open it (using the public key), could it then pass the unmodified (encrypted) parcel which it received from the server? Yes, the attacker can do that, that's why private key is never used to encrypt data. Public key is used to 1) cryptographically sign data, and 2) decrypt data sent via the corresponding public key. Vice versa, the public key is used to 1) authenticate (verify) signed data and, 2) to encrypt data to the holder of the corresponding private key. – Lie Ryan Nov 1 '16 at 2:19
9

No. A cryptographic system that only protected half of the information would just be slightly better than useless.

During the handshake, a symmetric key is exchanged. After the handshake, that symmetric key is used to encrypt all data (usually with AES). So without that symmetric key you are toast - you can not read 50%, you can read 0%.

When RSA is used for key exchange, the client encrypts a random symmetric key with the servers public key. Since the attacker does not know the servers private key, she can not decrypt it.

When Diffie-Hellman is used for key exchange, it also makes it possible to establish a symmetric key without an eavesdropper being able to get it.

  • 1
    If anonymous Diffie-Hellman is used, a MITM can decrypt everything. But you should never use ADH unless you need protection only from passive interception. – David Schwartz Nov 1 '16 at 2:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.