证书如何避免中间人攻击? [英] How do certificate avoid the man in the middle attack?
问题描述
我还有一个关于网络安全的问题.如果我理解正确，证书用于识别您的真实身份.所以中间人攻击是不可能的.但是当我看到这张图片时:
I have another question to security in the web. If I understand it correctly certificates are for identify who you really are. So the man in the middle attack isn't possible. But when I see this image:
我认为中间人攻击是可能的.您可以从数据中拆分签名、证书.用你的假数据制作你自己的签名，并将带有假签名(但正确的证书)的假数据发送到服务器/客户端.
I think a man in the middle attack is possible. You could split the Signature, the certificate from the data. Make your own signature with your fake data and send the fake data with the fake signature (but the right certificate) to the server/client.
我在这张图片中也不明白的是，在验证方面，证书在哪里被检查.
What I also not understand in this picture is where the certificate gets checked, on the verification side.
谢谢.
SCBoy
推荐答案
用你的假数据制作你自己的签名，并将带有假签名(但正确的证书)的假数据发送到服务器/客户端.
Make your own signature with your fake data and send the fake data with the fake signature (but the right certificate) to the server/client.
问题是接收者随后会查看伪造的签名，发现它与真实发送者的证书不匹配.
The problem is that the receiver will then look at the fake signature and see that it does not match the certificate of the real sender.
只有当您拥有该证书的正确私钥时，您才能创建与该证书匹配的签名(即使证书本身是公开的，这就是非对称加密的神奇之处).该私钥由证书所有者(消息的原始发送者)保密.
You can only create signatures that match a given certificate when you have the correct private key for that certificate (even though the certificate itself is public, that is the magic of asymmetric cryptography). This private key is being kept secret by the owner of the certificate (the original sender of the message).
通过提前分发可信证书来防止中间人.您必须信任证书的真实性，方法是直接信任它们(根证书)，或者信任证书上的一系列签名，最终指向您信任的签名.
The man-in-the-middle is prevented by distributing trusted certificates in advance. You have to trust the authenticity of the certificates, either by trusting them directly (root certificates) or by trusting a chain of signatures on the certificate leading up to one that you trust.
如果中间那个人能让你相信他的假证书是真的，那么整个系统就会失败.
If the man in the middle can make you believe that his fake certificate is the real deal, then the whole system fails.
这篇关于证书如何避免中间人攻击?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
