1

My question is what happen if an attacker takes an encrypted packet from the network and send it on his/her behalf to the server. How server will identify that it is not a legitimate user. In HTTP using cookies we get the identity of a user otherwise, HTTP is stateless protocol, Now how does HTTPS makes it stateful?

techraf
  • 9,149
  • 11
  • 44
  • 62
user156991
  • 11
  • 1
  • 1
    I think you're misunderstanding what TLS does and how it relates to HTTP. TLS doesn't (usually) authenticate the client, just the server; if you want to authenticate the client, you still need something like cookies. It also doesn't make HTTPS stateful. In HTTPS, the HTTP and TLS layers are mostly independent. – Gordon Davisson Feb 14 '17 at 07:07

2 Answers2

1

You mentioned that the attacker is "taking an encrypted packet from the network". The packet is encrypted, so the attacker can't read it or modify it. If the attacker could read it or modify it, he must know the key (or have broken the encryption, but that is very unlikely for modern cipher suites). HTTPS does not protect against an attacker who knows the key. Knowledge of the key is the identification of the legitimate user.

Owen
  • 574
  • 5
  • 9
0

You cannot simply take one packet out of a TLS stream and put it into some other TLS stream because at least the encryption key differs and thus the decryption will fail. Also you cannot take a packet and put it again into the same TLS stream at some other position because TLS also protects against such replay attacks. For more details see How does SSL/TLS work?

Community
  • 1
Steffen Ullrich
  • 190,458
  • 29
  • 381
  • 434
  • ok, due to the different secret key for attacker and user decryption will fail on server side, Can we extract secret key from the browser, because the browser is involved during TLS handshake? How browser secured these key? – user156991 Feb 14 '17 at 06:03
  • 1 more question, how HTTPS became stateful because if HTTPS can differentiate b/w an attacker and user without using cookies of application layer, how this is going to happen? – user156991 Feb 14 '17 at 06:08
  • @user156991: if you hack the endpoint (i.e. browser, server) you can extract the encryption keys for a running connection. As for the second question: TLS cannot distinguish between attacker and a specific user, it can only distinguish between valid and invalid (i.e. corrupt, replay...) packets. HTTPS does not get stateful just because TLS is involved, i.e. the encryption and the HTTP layer don't interact with each other. – Steffen Ullrich Feb 14 '17 at 09:24