2

Given a conversation is occurring using HTTPS, during the handshake, can the man in the middle interpret all communication from the server to the client?

Assuming that the man in the middle can receive the packet, and open it (using the public key), could it then pass the unmodified (encrypted) packet which it received from the server? It would receive back a packet encrypted using the public key (which it would not be able to interpret), but would this allow the man in the middle to eavesdrop half the conversation?

Improve this question
1
  • Assuming that the man in the middle can receive the parcel, and open it (using the public key), could it then pass the unmodified (encrypted) parcel which it received from the server? Yes, the attacker can do that, that's why private key is never used to encrypt data. Public key is used to 1) cryptographically sign data, and 2) decrypt data sent via the corresponding public key. Vice versa, the public key is used to 1) authenticate (verify) signed data and, 2) to encrypt data to the holder of the corresponding private key.
    – Lie Ryan
    Nov 1, 2016 at 2:19

1 Answer 1

Reset to default
9

No. A cryptographic system that only protected half of the information would just be slightly better than useless.

During the handshake, a symmetric key is exchanged. After the handshake, that symmetric key is used to encrypt all data (usually with AES). So without that symmetric key you are toast - you can not read 50%, you can read 0%.

When RSA is used for key exchange, the client encrypts a random symmetric key with the servers public key. Since the attacker does not know the servers private key, she can not decrypt it.

When Diffie-Hellman is used for key exchange, it also makes it possible to establish a symmetric key without an eavesdropper being able to get it.

Improve this answer
1
  • 1
    If anonymous Diffie-Hellman is used, a MITM can decrypt everything. But you should never use ADH unless you need protection only from passive interception.
    – David Schwartz
    Nov 1, 2016 at 2:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .