Why middleman cannot capture the encryption key of https/tor traffic?

Question

When we use Tor or https traffic , the encryption- decryption key has to be exchanged between the browser and the website server. Why somebody who can capture entire traffic , say ISP or somebody who controls the wifi router, cannot capture the key and hence read the actual content of the encrypted traffic ?

Answer 1

This is the basics of Asymmetric Key Encryption (or public key encryption). Each party has a key pair, a public key and private key.

You can encrypt data with the public key, but it can only be decrypted with the private key. Now, there is a performance hit when using public keys, so usually a symmetric key is set up. The problem is that we need to have a secure way to distribute our key. Public key cryptography is used to securely exchange that key.

In it's most simplified form, a client creates a secret key K, and encrypt this using the server's public key. Now, only the server can decrypt this, and K is used to encrypt all further traffic.

K is never transferred in clear text, so even though an ISP collects all traffic between client and server, they'll never know what K is. (That is, unless there are vulnerabilities).

As said, there's a lot more to see (SSL negotiation, etc...) when setting up an SSL tunnel, but that's the general idea.