I just saw a video at CNN in which it is claimed that, if the server isn't generating a random public key, the server can be hacked.
First how HTTPS works… to be sure I’m on the same page:
- Server has a public key and a private key. Client uses the public key to encrypt data before sending it to the server. Then the server uses its private key to decrypt that data… which is the only way to decrypt it.
- Client makes sure – using an SSL service provider – that the public key the server is offering is indeed genuine and belongs to that server. Otherwise, if someone “in-the-middle” would change the key, then that someone (via a fake server) would be able to read the data instead of the actual server.
- Does a server that offers HTTPS have to update its public key for every request it gets? Or is it true that – usually – it doesn't and therefore the claimed flaw exists?
- How is the man in the video able to get the password? How is he able decrypt without using the private key?
If my understanding of SSL is bad, so it would be nice if you could explain this flaw to me.