|
Posted by Sebastian Gottschalk on August 21, 2006, 5:14 pm
If you were Registered and logged in, you could reply and use other advanced thread options
jois.de.vivre@gmail.com wrote:
>>From what I've read I've come to understand that a server will
> digitally sign a certificate by first creating a hash, then encrypting
> the hash using its private key. The server will then send the
> digitally signed certificate to the client, who decrypts it using the
> public key and compares it with the hash value it calculates for the
> certificate.
> What prevents an attacker from decoding the certificate, substituting
> his own information, re-calculating the hash, re-encrypting it using
> his own private key and sending it to the client along with a new
> public key?
That the verification process will fail? The client won't take the
attackers public key, but the the real certifier's key.
| 
XML site map