Breaking TLS security by fully recording the handshake

Question

I have been looking at TLS recently, and I am unsure as to why it is so secure, but probably thanks to a misunderstanding of how it works. But if the entire handshake is recorded, either using a man in the middle attack or a packet sniffer on the target computer, then any of the remaining communication can be decrypted as you would have all the info that the client and the server used to generate the encryption keys.

I doubt there would be such a hole in tls, but could anyone tell me how tls defends against this?

Woke

A) amazon.com/Applied-Cryptography-Protocols-Algorithms-Edition/dp/… but more importantly B) why do you think that you have the keys after sniffing the packets? – Bollen

because all the keys are generated from the sent data, at least, thats what the specs say. the premaster key that is used to generate the master key is based on info that is all sent between the client and server during the handshake, but nice book, definitely worth a look – Woke

Aha - I understand the confusion - Mark's links should be a good read. – Bollen

Answer 1

The critical data sent by the client to the server in the TLS handshake is encrypted using the server's public key. So even if the packets are captured on the wire, it would require the private key (which is assumed to be known only to the server) to decrypt the packets.

Kempf

why does it require the private key if it is encrypted with the public key? – Woke

@cgoddard: Public key encryption is not symmetrical. If you encrypt something with the public key, then it can only be decrypted with the private key. The link I included discusses it some. – Kempf

ah, just been having a read of it atm, but certainly seems interesting, thanks guy – Woke

@cgoddard: One thing to note about this handshake: public key crypto tends to be more computationally expensive than symmetric crypto - this is why public key crypto is used at first, to exchange a key for the symmetric cryptography. – Bollen

This depends on the key exchange algorithm. What you said works for RSA key exchange but not for DH(E) key exchange (also quite common). – Stroh

Answer 2

The main purpose of the handshake is to ensure the secret exchange of a pre master secret that is then shared by both parties (which then leads to a common master secret and shared encryption keys).

How this is done depends on the cipher suites, and which key exchange algorithm is used. Using authenticated key exchange, there are mainly two variants:

• RSA key exchange, where the client encrypts the pre-master secret with the server's public key (obtained from the certificate).
• Diffie-Hellman key exchange, where the client verifies the server's signed DH parameters with the server's public key.

You may be interested in these links:

• TLS 1.1: Authentication and Key Exchange (not anonymous key exchange)
• why does the first certificate have a RSA public key in x.509?
• How to see the encrypted key in wireshark, during ssl key exchange?
• Why different key exhange techniques for ssl key exchange? (see discussion about ephemeral Diffie-Hellman).

Stroh