Tell me more ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.
up vote 3 down vote favorite

I read briefly over the TSL/SSL key exchange protocol. I have to wonder about the whole pre-master-key procedure. Wouldn't it be sufficient if the client or server encrypted a generated session key with the other sides public key? Why the extra work?

share|improve this question

1 Answer

up vote 3 down vote accepted

The nonces prevent replay attacks. If the server didn't include a value into the handshake that's different for each connection, an attacker can record a connection and replay it. Mixing a server determined nonce into the key is an easy way to prevent such attacks.

share|improve this answer
Okay, good point. So when the client generates the session key, one could easily repeat the exact same conversation later. One doesn't know what effects that will have, but they're potentially not desired. But when the server generates the session key - shouldn't that be fine? Is there some technical reason why the server doesn't just generate the full session key and sends it to the client? – cooky451 Dec 2 '12 at 15:00
How would that work? You can't encrypt the session key with the client's public key, because it usually doesn't have one. There are different ways to avoid replay problems, using a nonce on both sides that's mixed into the session key is just one easy solution. – CodesInChaos Dec 2 '12 at 15:04
The client usually doesn't have a public key? Why not? Is it that hard to generate one? – cooky451 Dec 2 '12 at 15:35
Generating one is easy in principle, but apart from client authentication(rarely used) and ephemeral key-change(for forward privacy) it's not that useful. IMO one should always use ECDHE where neither side creates the session key, and instead it's the result of a key-exchange operation. – CodesInChaos Dec 2 '12 at 16:07
1  
"Assuming the messages can be read by a third party, but not manipulated." We generally avoid that assumption, since usually being in a position to read messages allows you to manipulate them as well. – CodesInChaos Dec 2 '12 at 18:14
show 5 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.