Linked Questions

110 votes
6 answers

Why can't I MitM a Diffie-Hellman key exchange?

After reading the selected answer of "Diffie-Hellman Key Exchange" in plain English 5 times I can't, for the life of me, understand how it protects me from a MitM attack. Given the ...
orokusaki's user avatar
  • 1,362
65 votes
6 answers

SSL with GET and POST

I'm pretty new to security, so forgive my basic question, but does SSL encrypt POST requests but not GET requests? For instance, if I have two requests GET:
TomJ's user avatar
  • 753
76 votes
3 answers

symmetric encryption session keys in SSL/TLS

This question concerns the session send and receive keys used in SSL/TLS protocol. my understanding is that this key uses symmetric encryption (DES, AES, BlowFish, etc.) I'm wondering, if public-...
lurscher's user avatar
  • 1,230
70 votes
5 answers

Understanding 2048 bit SSL and 256 bit encryption

On DigiCert's page, they advertise a 2048 bit SSL with a 256 bit encryption: What exactly is the difference here and why are two encryption bits ...
JohnJ's user avatar
  • 867
32 votes
5 answers

SSH - If Eve has the passphrase and public key, can she derive the private key?

I have used ssh-keygen for creating an RSA 4096-bit SSH private and public key pair. I used a passphrase for the private key. If an attacker, Eve, knows the passphrase in addition to the public key: ...
unseen_rider's user avatar
22 votes
5 answers

How can I explain the concept of public and private keys without technical jargon? [duplicate]

Possible Duplicate: Principle of asymmetric algorithm in plain english In the spirit of How can I explain SQL injection without technical jargon?, do you have any suggestions on how to explain ...
NickAldwin's user avatar
28 votes
1 answer

My understanding of how HTTPS works (gmail for example)

I want to ask if my below understanding is correct or not regarding the HTTPS used for the webpage we are visiting. I will use Gmail as an example: My laptop tries to connect to the Gmail server ...
Xianlin's user avatar
  • 409
12 votes
3 answers

Preventing a spoofing man in the middle attack?

I was humming along with my usual routine of listening to old Defcon videos trying to understand some of the basics of what's going on in the IT Security world, when I came across one explaining man ...
Griffin Nowak's user avatar
6 votes
2 answers

Is it possible to decrypt a SSL/TLS session without doing a MITM-attack?

I'm not talking about decrypting the connection while the SSL/TLS is happening (MITM) but after the connection is closed and I have a pcap file of the entire negotiation/data transfer process. How ...
YSY's user avatar
  • 2,259
4 votes
3 answers

Public key in SSL protocol

I have gone through many of the posts including My understanding of how HTTPS works (gmail for example). Everywhere it's mentioning that before creating a https connection, the browser verifies the ...
kevin's user avatar
  • 63
7 votes
2 answers

How are two systems able to set up a secure SSH tunnel over a public connection?

As I understand it, when two systems create a secure SSH tunnel, the first step involves communicating the 'guidelines' for the encryption of that tunnel. If an third system is able to listen in on ...
Hoytman's user avatar
  • 483
2 votes
2 answers

Can a wifi provider decrypt HTTPS usind MITM without users noticing? [duplicate]

As a router, can I send forged certificates, and intercept requests to CA and return responses that they are valid. So I could MITM all https traffic, and spy on my users?
Antonio's user avatar
  • 31
2 votes
3 answers

IPSec VPNs and symmetric keys

When dealing with IPSec based VPNs, I understand that there is a slight "problem" with symmetric key exchange. Obviously, you can't send the keys over the VPN, since they are used to guarantee the ...
SwaroopGiwali's user avatar
4 votes
1 answer

What would be a simple example of an asymmetric encryption function (asymmetric function)?

I am trying to understand RSA encryption but the algorithm seems quite complex. I know that with asymmetric encryption you use a key and a function to encrypt data and a different function to decrypt ...
yoyo_fun's user avatar
  • 183
4 votes
1 answer

CSR from IIS 8 and Keeping my Private Key a Secret

I've been trying to understand something. When you generate a CSR from IIS, how is the private key kept as a secret, or is it? Do CA's email you a certificate that includes your private key? Because ...
Alexandru's user avatar
  • 175

15 30 50 per page