Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I was reading this article, specifically the "SSL in action" part. It says:

When Client connects to company.com on its SSL-secured port, the company sends back its public key (and some other information, like what Ciphers it supports).
...
Once the client is happy with the server (and the server with the client, if needed), then the client choose an SSL Cipher to use from the list of encryption methods provided by the server, and generates a “symmetric key” (password) for use with that Cipher. The client encrypts this password using the server’s public key and sends it back to the server. The server (and only the server) can decrypt this message and get this password, which is now shared by both the client and server.

So, my understanding is that there is only one public key; the one that is given to company.com by the trusted 3rd party (thawte/godaddy/verisign etc). The client then chooses to accept this key/certificate and then sends a password used to encrypt future communications.

If there is only one public key, then can't a hacker just go that site once, get a copy of the public key, then intercept the client as he sends the password, decrypt it using the public key he already has, and then spy on all future communications? What prevents that?

The part I don't understand is

The server (and only the server) can decrypt this message and get this password

Why can only the server decrypt the message? What prevents others from decrypting it?

share|improve this question
add comment

1 Answer

up vote 6 down vote accepted

The Public Key is one way. You can not decrypt the communication with it. You need the private part of the key pair to do the decryption.

share|improve this answer
2  
See en.wikipedia.org/wiki/Asymmetric_key for a really good description. –  Bill Heller Jul 12 '11 at 1:15
    
Thanks for that link. This was going to lead me to my next question... if the client can encrypt things, why can't he deduce an algorithm to decrypt it? Aren't all mathematical relationships reversible (plus/minus, multiply/divide, power/log), unless information is thrown out (non 1-to-1 relationships) such as in hashing? But I guess this sentence explains it "They are based on mathematical relationships (most notably the integer factorization and discrete logarithm problems) which have no efficient solution." But technically, we could produce the private key from the public key... –  Mark Jul 12 '11 at 1:34
    
...it's just that it would take a ridiculous amount of time (several lifetimes I'm guessing)? –  Mark Jul 12 '11 at 1:35
2  
Exactly. I'm sure a sharp mathematician could give you something more specific, but given limited computer resources (As in, you don't have a 10000 node Linux cluster) There is no hope to do the calculations needed in a reasonable amount of time (as in, the time left before the sun is a charcoal briquette) Of course as computing power increases, perhaps it will be more feasible, but you will always run into cost/benefit problems. Even if you have the super computer, you have to make more money with the hack than it cost to set up the system and run it. –  Bill Heller Jul 12 '11 at 1:54
    
@Bill Heller Charcoal briquette is no joke, according to Verisign at current computer processing speeds an attacker (with a single PC presumably) would need 1 trillion years to crack a 128 bit encrypted SSL session. –  Andrew Lambert Jul 12 '11 at 2:38
show 4 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.