On Fri, Aug 28, 2009 at 02:38:50PM -0700, Rene Hollan wrote:
> I understand that's the case as the exchange progresses, but even when
> just having exchanged Hellos and gotten a server cert?
You can't MITM kEDH without changing the pre-master secret, which
means that you MUST stay in the middle if you don't want to disrupt
the connection.
You may be able to MITM kRSA and later drop out, but I am far from sure
about this, it is just not obvious to me why you can't provided the
"client random" and "server random" are not changed by the proxy.
--
Viktor.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [email protected]
Automated List Manager [email protected]
