SSL weakness

[adithyay328]

Hello there! So, I have a burning question. I understand that keys are exchanged when an SSL connection is created, but is there a mechanism for stopping a hacker from stealing the keys when they're initially sent(like, at the start of the connection)? Because, if a hacker knows your IP, they could just wait for you to start a connection, take the keys, then decrypt everything you're doing! Is there a mechanism to stop this? Thanks!

[DXMember]

the keys sent are encrypted

maybe you want to read up on public key encryption, also Heartbleed

[adithyay328]

1 minute ago, DXMember said:

the keys sent are encrypted

Well, how does the other end decrypt the keys. Do they send another set of keys, or what?

[DXMember]

1 minute ago, adithyay328 said:

Well, how does the other end decrypt the keys. Do they send another set of keys, or what?

read the reply again, I edited it (:

[adithyay328]

 

1 minute ago, DXMember said:

read the reply again, I edited it (:

Ok, will look at it

[adithyay328]

5 minutes ago, DXMember said:

read the reply again, I edited it (:

OMG, I'M SO DUMB. I get it know! Thank you so much!

[DXMember]

1 minute ago, adithyay328 said:

OMG, I'M SO DUMB. I get it know! Thank you so much!

(:

[Wombo]

8 hours ago, adithyay328 said:

Hello there! So, I have a burning question. I understand that keys are exchanged when an SSL connection is created, but is there a mechanism for stopping a hacker from stealing the keys when they're initially sent(like, at the start of the connection)? Because, if a hacker knows your IP, they could just wait for you to start a connection, take the keys, then decrypt everything you're doing! Is there a mechanism to stop this? Thanks!

Well basically private keys are never shared, only public keys are exchanged.

 

Think;

Private Key, My key, no one else can have it, this is used to decrypt messages that have been encrypted with my public key

Public Key, I give this out to everyone so they can communicate to me securely. This key cannot decrypt a message it has encrypted, only the private key can do this.

 

See: Asymmetric Cryptography

Essentially, public key encrypts, private key decrypts. Public key CANNOT decrypt and private key CANNOT encrypt. It goes in one direction and one direction only.

 

Also, Heartbleed was mentioned in an above response but that was not an attack on the encryption itself, more of a bug with blocks of nul-data being sent. Not something I would suggest looking into if you want to learn about SSL.

 

Edit: I am aware symmetric cryptography is also used to encrypt the data, however this is the exchange that occurs only after the asymmetric or "public" cartographic pairs have been exchanged. The "secret sauce" of SSL/TLS, is the asymmetric key exchange, which keeps the symmetric key safe.