Skip to main content
replaced https://tools.ietf.org/html/rfc with https://www.rfc-editor.org/rfc/rfc
Source Link

For (EC)DHE cipher suites, server authenticates itself by proving the possession of the private key matching its certificate by signing ServerKeyExchange message (linklink):

  struct {
      select (KeyExchangeAlgorithm) {
          case dh_anon:
              ServerDHParams params;
          case dhe_dss:
          case dhe_rsa:
              ServerDHParams params;
              digitally-signed struct {
                  opaque client_random[32];
                  opaque server_random[32];
                  ServerDHParams params;
              } signed_params;
          case rsa:
          case dh_dss:
          case dh_rsa:
              struct {} ;
             /* message is omitted for rsa, dh_dss, and dh_rsa */
          /* may be extended, e.g., for ECDH -- see [TLSECC] */
      };
  } ServerKeyExchange;

For RSA cipher suites, server authenticates itself by proving the possession of the private key matching its certificate by decrypting pre-master secret sent by client in ClientKeyExchange message (linklink):

struct {
    select (KeyExchangeAlgorithm) {
        case rsa:
            EncryptedPreMasterSecret;
        case dhe_dss:
        case dhe_rsa:
        case dh_dss:
        case dh_rsa:
        case dh_anon:
            ClientDiffieHellmanPublic;
    } exchange_keys;
} ClientKeyExchange;

How does the server authenticate itself and prove possession of the private key matching its cert for static DH? It won't send ServerKeyExchange, because its public key embedded in its certificate already contains relevant info. Client won't send ClientKeyExchange with EncryptedPreMasterSecret, because this is not RSA.

Does the server prove possession of the private key solely by being able to arrive at the same master secret as the client?

For (EC)DHE cipher suites, server authenticates itself by proving the possession of the private key matching its certificate by signing ServerKeyExchange message (link):

  struct {
      select (KeyExchangeAlgorithm) {
          case dh_anon:
              ServerDHParams params;
          case dhe_dss:
          case dhe_rsa:
              ServerDHParams params;
              digitally-signed struct {
                  opaque client_random[32];
                  opaque server_random[32];
                  ServerDHParams params;
              } signed_params;
          case rsa:
          case dh_dss:
          case dh_rsa:
              struct {} ;
             /* message is omitted for rsa, dh_dss, and dh_rsa */
          /* may be extended, e.g., for ECDH -- see [TLSECC] */
      };
  } ServerKeyExchange;

For RSA cipher suites, server authenticates itself by proving the possession of the private key matching its certificate by decrypting pre-master secret sent by client in ClientKeyExchange message (link):

struct {
    select (KeyExchangeAlgorithm) {
        case rsa:
            EncryptedPreMasterSecret;
        case dhe_dss:
        case dhe_rsa:
        case dh_dss:
        case dh_rsa:
        case dh_anon:
            ClientDiffieHellmanPublic;
    } exchange_keys;
} ClientKeyExchange;

How does the server authenticate itself and prove possession of the private key matching its cert for static DH? It won't send ServerKeyExchange, because its public key embedded in its certificate already contains relevant info. Client won't send ClientKeyExchange with EncryptedPreMasterSecret, because this is not RSA.

Does the server prove possession of the private key solely by being able to arrive at the same master secret as the client?

For (EC)DHE cipher suites, server authenticates itself by proving the possession of the private key matching its certificate by signing ServerKeyExchange message (link):

  struct {
      select (KeyExchangeAlgorithm) {
          case dh_anon:
              ServerDHParams params;
          case dhe_dss:
          case dhe_rsa:
              ServerDHParams params;
              digitally-signed struct {
                  opaque client_random[32];
                  opaque server_random[32];
                  ServerDHParams params;
              } signed_params;
          case rsa:
          case dh_dss:
          case dh_rsa:
              struct {} ;
             /* message is omitted for rsa, dh_dss, and dh_rsa */
          /* may be extended, e.g., for ECDH -- see [TLSECC] */
      };
  } ServerKeyExchange;

For RSA cipher suites, server authenticates itself by proving the possession of the private key matching its certificate by decrypting pre-master secret sent by client in ClientKeyExchange message (link):

struct {
    select (KeyExchangeAlgorithm) {
        case rsa:
            EncryptedPreMasterSecret;
        case dhe_dss:
        case dhe_rsa:
        case dh_dss:
        case dh_rsa:
        case dh_anon:
            ClientDiffieHellmanPublic;
    } exchange_keys;
} ClientKeyExchange;

How does the server authenticate itself and prove possession of the private key matching its cert for static DH? It won't send ServerKeyExchange, because its public key embedded in its certificate already contains relevant info. Client won't send ClientKeyExchange with EncryptedPreMasterSecret, because this is not RSA.

Does the server prove possession of the private key solely by being able to arrive at the same master secret as the client?

Source Link
user80928
user80928

Server authentication in TLS 1.2 with static DH

For (EC)DHE cipher suites, server authenticates itself by proving the possession of the private key matching its certificate by signing ServerKeyExchange message (link):

  struct {
      select (KeyExchangeAlgorithm) {
          case dh_anon:
              ServerDHParams params;
          case dhe_dss:
          case dhe_rsa:
              ServerDHParams params;
              digitally-signed struct {
                  opaque client_random[32];
                  opaque server_random[32];
                  ServerDHParams params;
              } signed_params;
          case rsa:
          case dh_dss:
          case dh_rsa:
              struct {} ;
             /* message is omitted for rsa, dh_dss, and dh_rsa */
          /* may be extended, e.g., for ECDH -- see [TLSECC] */
      };
  } ServerKeyExchange;

For RSA cipher suites, server authenticates itself by proving the possession of the private key matching its certificate by decrypting pre-master secret sent by client in ClientKeyExchange message (link):

struct {
    select (KeyExchangeAlgorithm) {
        case rsa:
            EncryptedPreMasterSecret;
        case dhe_dss:
        case dhe_rsa:
        case dh_dss:
        case dh_rsa:
        case dh_anon:
            ClientDiffieHellmanPublic;
    } exchange_keys;
} ClientKeyExchange;

How does the server authenticate itself and prove possession of the private key matching its cert for static DH? It won't send ServerKeyExchange, because its public key embedded in its certificate already contains relevant info. Client won't send ClientKeyExchange with EncryptedPreMasterSecret, because this is not RSA.

Does the server prove possession of the private key solely by being able to arrive at the same master secret as the client?