Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

When a 2 computer establish an HTTPS connection them have to resolve what key is going to be used, right?

So, to do that, at some point the key have to travel unencrypted from one computer to another, no?. At that moment, isn't it possible to a man-in-the-middle to sniff it and get the key, so then he can just read/write the encrypted packets with it?

How does the HTTPS protocol avoids that?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

SSL uses two keys, a private and a public one. Only the public key is sent and this key has no value unless you know the private one.

Every party is encrypting the data it sends with the public key of the other one (that's a little bit more complex but you got the idea). Only the recipient is able to (easily) decode the traffic.

That means that traffic sniffing is so not that much a problem, although of course brute force attacks would be depending on the key size and algorithm used.

Man in the middle attacks based on traffic interception and server substitution are a higher risk but normally prevented by the use of trusted certification authorities. It would however be defeated if you ignore the warnings your browser displays when a server certificate isn't matching the site name or hasn't been issued by a trusted chain of authorities (eg: self signed certificate).

share|improve this answer

The HTTPS/SSL protocol uses Private/Public Keys to ensure a secure connection. http://en.wikipedia.org/wiki/Transport_Layer_Security

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.