3 ms·
If don't trust a server, then any strong protocol that results in a secure shared secret or session key is trivially sidestepped by the server intentionally lea
by PeterisP 6y ago
If don't trust a server, then any strong protocol that results in a secure shared secret or session key is trivially sidestepped by the server intentionally leaking these secrets or keys.
- ben_w 6y agoTwo interpretations of the same phrase: 1. Do you trust that 123.123.123.123 is the real https://example.com https://example.com ? 2. Do you trust the real https://example.com https://example.com to not leak? The protocol is for 1. You’re right that nothing can help with 2.
- dependenttypes 6y agoI trust the server only after I verify its PK. SSH performs mutual authentication.