I have read this section and I am still a little confused, as well as read a few of the posts here: https://www.acunetix.com/blog/articles/establishing-tls-ssl-connection-part-5/

So, the client sends a random number + cipher suites and TLS version it supports. The server responds back with its own random number, which cipher suits and TLS to use, plus the cert / public key.

With this information, a private master symmetrical key is created. However, one thing I don't get, and maybe this website is explaining it poorly.

The client random is sent before encryption in the hello, so a MITM attack can see that number. On the way back, the server random is also send before encryption, so the MITM can see that number as well. And the public key is, well, public.

Up to this point, MITM can see the ciphers being used, the TLS being used, the public key, and both random numbers. How is the MITM attack not able to take that information and be able to figure out the private master key?

  • "With this information, a private master symmetrical key is created." - No, not only with this information. Marked as duplicate of a post which explains how the key is really created. Feb 3 at 21:54