Linked Questions
38 questions linked to/from How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?
111
votes
6
answers
33k
views
Why can't I MitM a Diffie-Hellman key exchange?
After reading the selected answer of "Diffie-Hellman Key Exchange" in plain English 5 times I can't, for the life of me, understand how it protects me from a MitM attack.
Given the ...
- 1,372
65
votes
6
answers
102k
views
SSL with GET and POST
I'm pretty new to security, so forgive my basic question, but does SSL encrypt POST requests but not GET requests?
For instance, if I have two requests
GET:
www.mycoolsite.com/index?id=1&type=...
- 753
78
votes
3
answers
30k
views
symmetric encryption session keys in SSL/TLS
This question concerns the session send and receive keys used in SSL/TLS protocol. my understanding is that this key uses symmetric encryption (DES, AES, BlowFish, etc.) I'm wondering, if public-...
- 1,250
70
votes
5
answers
210k
views
Understanding 2048 bit SSL and 256 bit encryption
On DigiCert's page, they advertise a 2048 bit SSL with a 256 bit encryption: http://www.digicert.com/256-bit-ssl-certificates.htm
What exactly is the difference here and why are two encryption bits ...
- 867
33
votes
5
answers
8k
views
SSH - If Eve has the passphrase and public key, can she derive the private key?
I have used ssh-keygen for creating an RSA 4096-bit SSH private and public key pair. I used a passphrase for the private key.
If an attacker, Eve, knows the passphrase in addition to the public key:
...
- 433
22
votes
5
answers
48k
views
How can I explain the concept of public and private keys without technical jargon? [duplicate]
Possible Duplicate:
Principle of asymmetric algorithm in plain english
In the spirit of How can I explain SQL injection without technical jargon?, do you have any suggestions on how to explain ...
- 320
28
votes
1
answer
25k
views
My understanding of how HTTPS works (gmail for example)
I want to ask if my below understanding is correct or not regarding the HTTPS used for the webpage we are visiting.
I will use Gmail as an example:
My laptop tries to connect to the Gmail server ...
- 409
12
votes
3
answers
7k
views
Preventing a spoofing man in the middle attack?
I was humming along with my usual routine of listening to old Defcon videos trying to understand some of the basics of what's going on in the IT Security world, when I came across one explaining man ...
- 1,200
6
votes
2
answers
11k
views
Is it possible to decrypt a SSL/TLS session without doing a MITM-attack?
I'm not talking about decrypting the connection while the SSL/TLS is happening (MITM) but after the connection is closed and I have a pcap file of the entire negotiation/data transfer process.
How ...
- 2,259
4
votes
3
answers
3k
views
Public key in SSL protocol
I have gone through many of the posts including My understanding of how HTTPS works (gmail for example). Everywhere it's mentioning that before creating a https connection, the browser verifies the ...
- 63
7
votes
2
answers
746
views
How are two systems able to set up a secure SSH tunnel over a public connection?
As I understand it, when two systems create a secure SSH tunnel, the first step involves communicating the 'guidelines' for the encryption of that tunnel. If an third system is able to listen in on ...
- 483
2
votes
2
answers
4k
views
Can a wifi provider decrypt HTTPS usind MITM without users noticing? [duplicate]
As a router, can I send forged certificates, and intercept requests to CA and return responses that they are valid.
So I could MITM all https traffic, and spy on my users?
- 31
2
votes
3
answers
5k
views
IPSec VPNs and symmetric keys
When dealing with IPSec based VPNs, I understand that there is a slight "problem" with symmetric key exchange. Obviously, you can't send the keys over the VPN, since they are used to guarantee the ...
- 653
4
votes
1
answer
2k
views
What would be a simple example of an asymmetric encryption function (asymmetric function)?
I am trying to understand RSA encryption but the algorithm seems quite complex.
I know that with asymmetric encryption you use a key and a function to encrypt data and a different function to decrypt ...
- 183
4
votes
1
answer
2k
views
CSR from IIS 8 and Keeping my Private Key a Secret
I've been trying to understand something. When you generate a CSR from IIS, how is the private key kept as a secret, or is it? Do CA's email you a certificate that includes your private key? Because ...
- 175