1.6 KiB
certificates
when we connect to site like github.com it is not a direct connection to github IP, there are so many entries in the middle like router,isp and many route nodes. if any of these entries is compromised then man in the middle attack can take place
- dns spoofing : github.com will now lead to another IP. can happen when router or isp is compromised
- arp (address resolution protocol) spoofing : arp maps ipv4 to mac address. this happens in public wifi usually and shared network. attacker will send signal and claim to be router and it will claim victim device to router so now every information will route through attacker device
- ssl/tls stripping. related to 2nd one and in this downgrading security to http.
Now a trusted certificates can prevent these attacks by giving a identity to all the sites so impersonation becomes impossible. browsers have a list of root CAs (Certificate Authority)which gives mapping of public keys to sites. so lets say public key is 'AAA' and site is github.com and signed by digicert and if man in the middle attack take place then he will never have this public key 'AAA' signed by digicert. (Note: there can me multiple keys ofc but those need to be signed by that CA) so he in case of dns spoofing the wrong ip will have invalid cerificate, connection wont be extablished to impoersonation one ever bcz certificates wont be valid ever.
What if CA is comprmised by weak private key? then an attacker can generate certificate for his and compormised isp or router can impersonate them by generating certificates using the leaked private key.