3 ms·
> you can probably do some sort of DHE Could the browser send a symmetric key encrypted in the public key of the target website, as part of the initial challen
by AlexCoventry 9y ago
> you can probably do some sort of DHE
Could the browser send a symmetric key encrypted in the public key of the target website, as part of the initial challenge?
- infogulch 9y agoThe point is you don't know what the public key of the target website is. You find out by asking for it, and then you verify it's authenticity by checking the signature. Before you connect all you know is the domain and the keys of CA's you trust.
- AlexCoventry 9y agoAh, right. Thanks.