SSL uses Asymmetric Encryption like this :
- Server sends a copy of its asymmetric public key.
- Browser creates a symmetric session key and encrypts it with the server’s asymmetric public key.
- Server decrypts the asymmetric public key with its asymmetric private key to get the symmetric session key.
- Server and Browser now encrypt and decrypt all transmitted data with the symmetric session key.
But what happens if someone listens to this communication in "step 1", and does this:
- Listen to communication between server and client in step 1.
- When the server sends a copy of its asymmetric public key, hacker changes it to their own public key (that has its private key too) and sends it to client.
- Client create a session key and encrypts it with hacker's public key.
- Hacker listens to the line and gets the session key and decrypts it with its private key.
So he gets session key here. and then..
- Hacker encrypts the session key (that decrypted) by the last public key (that server sent)
- So the hacker has the session key now...
I used this algorithm in my project for communication between server and client. there is not any certification between them. is it right that I add some characters in public key and client checks them and makes it valid?
How we can fix it? any ideas?