On Fri, Aug 28, 2009 at 01:53:44PM -0700, Rene Hollan wrote:
> Here's my issue, in some cases, after receiving the server certificate,
> I may want to simply stitch the two ends together and drop out of the
> communication. I figure I can do this if the MITM and client SSL state
> are identical up to this point. That requires using the same SSL version,
> certificate suite, session ID, and challenge in the two Client Hello
> messages.
The client and server internal state is not necessarily fully disclosed
to the peer (in this case) MITM gateway, so the MITM gateway cannot
faithfully emulate one peer to the other to arrive at the same SSL state
(and still be able to decrypt and re-encrypt the traffic).
This is for example true with kEDH ciphers. There may be other obstacles,
but perhaps this is possible for weaker than kEDH cipher-suites.
--
Viktor.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [email protected]
Automated List Manager [email protected]
