> Is there a way to do an ephemeral (i.e., unauthenticated) encryption
> channel before transmitting whatever certificates are to be used for
> authentication? I tend to look at certificate disclosure as an
> "information leakage" issue, that gives Eve more information than she
> really has any business having. Mallory, of course, can accept an
> incoming request, then get the certificate of the one connecting...
> but that is prima facie evidence of a much more malicious intent than
> a simple eavesdropper. (A network administrator can capture traffic
> on a network for troubleshooting purposes -- and thus, put him/herself
> into the role of Eve. It would take a truly malicious intent to
> intercept the connection attempt.)
>
> More specifically, is there a way to do this in OpenSSL? :)
>
> Thanks for your time,
If you think disclosing public keys is an information leakage issue, you
don't trust the encryption you are using. I'd be extremely suspect about the
depth of your understanding of what actually goes on in an authentication.
DS
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [email protected]
Automated List Manager [EMAIL PROTECTED]
