Computer Networking Basics
In TLS, why can a browser conclude that the server it connects to is not an impostor?
- ABecause the certificate contains the shared key used for encryption, which only the genuine server knows
- BBecause the certificate is bound to the server's IP address, and IP addresses cannot be faked
- CBecause the certificate carries a signature made with a trusted certificate authority's private key and cannot be forged, and the server must also prove during the handshake that it holds the private key matching the certificate's public key
Show answer and explanation
Answer: C. Because the certificate carries a signature made with a trusted certificate authority's private key and cannot be forged, and the server must also prove during the handshake that it holds the private key matching the certificate's public key
A certificate is the statement "this is the public key for this domain name," signed by a certificate authority (CA) with its own private key. The browser verifies the signature with CA public keys built into the OS or browser, so an attacker cannot produce a valid signature and cannot forge a certificate. A genuine certificate, however, can be obtained by anyone and presented as is. So in the TLS handshake the server signs with the private key corresponding to the certificate's public key, proving that it holds that key. The shared keys actually used for encryption are created fresh by the handshake's key exchange (such as ECDHE) and are not in the certificate. Certificates are generally bound to domain names, not IP addresses.
- A. Shared keys are created by key exchange for each connection; the certificate contains a public key.
- B. Certificates are generally bound to domain names; authenticity is not judged by IP address.
- C. Correct. The CA signature proves the certificate is valid, and the private-key signature proves the server holds it.