3 ms·
Doesn't SSL/TLS use a per-session symmetric key that is exchanged using the asymmetric server keys? Is the point of this article that even that per-session priv
by noveltyaccount 13y ago
Doesn't SSL/TLS use a per-session symmetric key that is exchanged using the asymmetric server keys? Is the point of this article that even that per-session private key would be logged or re-generated and therefore prone to attack if the server private key were exposed?
- calmingbreeze 13y agoIf an eavesdropper records all traffic between client and server, he/she will also record the encrypted session key. If the server's private key is compromised, the eavesdropper can decrypt the session key and use it to read the rest of the communication for that session.
- noveltyaccount 13y agoThanks for clarifying, that makes sense.