If I communicate with a website that uses SSL/TLS, my browser will generate a private key. Would the browser store that key on the hard disk or would store just it in the RAM?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
If your browser and the remote server negotiate a DHE cipher suite, your browser will generate an ephemeral Diffie-Hellman key pair, using the system parameters sent by the server to the browser. Normally, this key pair will be (should be, ought to be) discarded once the SSL handshake is complete and a shared secret has been established.
There is however nothing in the SSL/TLS standard specifications that makes it impossible for an SSL client to save the key pair and reuse it for the next session to the same remote peer. Most correct implementations don't do this, since such an implementation would be inconsistent with perfect forward secrecy.
SSL does not generate a private key. What is generated is shared secret key between the client and server.This shared secret key is only valid till the session lasts. So, this shared secret key resides in the RAM. It is not saved in to the hard disk.