Could someone reuse client certificates?

To my understanding, if a server “cert+key” (RSA) is compromised, than the SSL/TLS network traffic can be decrypted.

What about a client “cert+key” (RSA)? Could someone reuse client certificates?

For example: can somebody with the client “cert+key” decrypt (or in otherwise mess with) the traffic of another user? (Yes, I know they can impersonate but that is not my question.)

-
A leak of the server side key only compromises past traffic if the RSA key exchange was used, not if (EC)DHE_RSA was used. –  CodesInChaos Dec 11 '13 at 14:13

To answer this question, we must have a look at how TLS/SSL works.

I guess you know that the aim of TLS/SSL is to authenticate communicating parties before setting up an encrypted connection through which application data will flow. And as you may already know, an SSL handshake/session will use asymmetric crypto for authentication and session setup and symmetric crypto for application data.

If you look at how a client-authenticated TLS handshakes are made, the only moment where asymmetric crypto may be used aside authentication is when the parties agree on the premaster secret (random data that will be derived into the symmetric key for the session). There are 2 ways of doing this (depending on the chosen cipher suite):

• The client generates a 48 byte premaster secret and encrypts it with the server's public key
• Or, the client and the server do a standard DH/ECDH computation (with ephemeral keypairs proper to this handshake) to agree on a premaster secret

You notice here that no information from the client's certificate/keypair has been used after the authentication. Therefore, if a user has his certificate/keypair compromised, it will/should not affect the other users.

-
thnx, that's what I thought. the client keypair is only used for auth not key xchng, unlike the server keypair where it is used for both (depending on the cipher suite) –  steelbytes Dec 11 '13 at 9:26