3 ms·
By "forge" I meant using the private keys (obtained through FISA, or possibly cracked) to either decrypt or MITM SSL sessions, not using one of their own CAs to
by tlrobinson 13y ago
By "forge" I meant using the private keys (obtained through FISA, or possibly cracked) to either decrypt or MITM SSL sessions, not using one of their own CAs to create a valid but obviously fake certificate, which I assume is what you thought I meant.
Maybe "forge" was the wrong word.
- Robin_Message 13y agoI think (not an expert) that with elliptic curve Diffie-Hellman (which e.g. Google uses), even with the private key and the whole session, you still can't decrypt the session (Diffie-Hellman provides a secure channel, public/private proves the server is who it says it is).
- sneak 13y agoThat is correct. These are referred to as ECDHE, or DHE for the non-ECC variant (vanilla DH). The last e is "ephemeral", referring to the lifetime of the session key. The property that this provides is known as "forward secrecy".