When we say a communication is secured by the latest version of TLS, can we say that Man-in-the-Middle attack is not possible? Do not consider the situations that we can down grade the communication protocol. With TLS, is it necessary the have certificate for the server?


If the TLS communication is properly secured then a middle attack is not practically possible. Properly secured includes authentication of the server in order to make sure that one is talking to (and exchanging the keys with) the expected server and not to some man in the middle attacker. There are various ways to authenticate the server, like certificates or pre-shared keys (PSK). Certificates within a public key infrastructure are the most used method though since they scale best with large setups (like the internet).

  • $\begingroup$ Thanks. I am considering a scenario where some users want to communicate confidentially with a server. One solution is using TLS. Can I say that the need for having a certificate is a disadvantage of the TLS option? $\endgroup$
    – Reza
    Sep 28 '19 at 14:53
  • $\begingroup$ @Reza: "...some users want to communicate confidentially with a server..." - this is a very broadly described scenario and just based on this one cannot say if TLS with certificate, TLS w/o certificate or something else is the best option. Anyway, I think this is no longer on-topic at Cryptography. You better ask about this (with a way more detailed description of the use case) at Information Security. $\endgroup$ Sep 28 '19 at 15:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.