Odi's astoundingly incomplete notes
New entries | CodeWhat the TLS private key is for really
People think that the private key of the server certificate protects the content of TLS messages. And so if someone obtains the private key they can decrypt a TLS connection. Well, not quite.
These days the private key is primarily used for authentication. So the server can prove that it is what its certificate claims it is. If a server presents a certificate for odi.ch then it needs the matching private key to prove that claim to clients. So losing the server key always enables identity theft and thus man-in-the-middle attacks.
The content of a TLS connection is encrypted using a session key (using a symmetrical algorithm like AES).
If that session key is exchanged using an insecure key exchange protocol then it is true: we can recover it. The original key exchange protocols did that. The client creates a pre-master secret and encrypts it with the server's public key, so it can be obtained with the server's private key. That pre-master secret is the basis for the session key.
If the session key is exchanged using a secure key agreement protocol (Diffie-Hellman) then we can not recover it. A secure key agreement protocol is able to produce a shared secret in plain sight without any encryption of the agreement protocol itself. It does not in any way depend on private key of either party.
These days the private key is primarily used for authentication. So the server can prove that it is what its certificate claims it is. If a server presents a certificate for odi.ch then it needs the matching private key to prove that claim to clients. So losing the server key always enables identity theft and thus man-in-the-middle attacks.
The content of a TLS connection is encrypted using a session key (using a symmetrical algorithm like AES).
If that session key is exchanged using an insecure key exchange protocol then it is true: we can recover it. The original key exchange protocols did that. The client creates a pre-master secret and encrypts it with the server's public key, so it can be obtained with the server's private key. That pre-master secret is the basis for the session key.
If the session key is exchanged using a secure key agreement protocol (Diffie-Hellman) then we can not recover it. A secure key agreement protocol is able to produce a shared secret in plain sight without any encryption of the agreement protocol itself. It does not in any way depend on private key of either party.
Add comment