Where is the private key when using SSL?

Question

Before using the ssl certificate between the service, which I will place on the local network, I would like to know a little more about this. From reading on the Internet, this is how I understand how SSL works.

• client connects to WCF service
• WCF service responds with public key and certificate
• the client then verifies the certificate and encrypts its credentials using the public key
• The wcf service then decrypts this message with the private key and checks the information
• etc...

Know, here are some things that I don’t understand:

• In step 4. where did the WCF service have its private key?
• Why do i need an SSL certificate? from reading on the Internet you need to make sure that the Service is who I want. This does not make sense to me, because at first I know the IP address of my service on my local network (I know who this service is). Pretend that this is not the case when I am on the Internet and someone is trying to hack me. In this case, I believe that if I connect to their service instead of my real one, I can do nothing, because if you recall in step 2, the WCF service responded with a public key and a certificate (in plain text), which means that can someone get this certificate and use it?
• If I use an SSL certificate, and someone has access to the computer on which the service is located, can he somehow get a private key that makes my connections unsafe?

Answer 1

Firstly, there are several steps in step 3. What actually happens in the third step:

• the client verifies the certificate
• the client and server send some messages back and forth, whereby they discuss which secret key encryption they both can use
• the client creates a secret key for this encryption algorithm, encrypts the secret key with the server’s public key and sends the encrypted secret key to the server.
• the server can now decrypt the private key using its private key.
• the client and server now agree on the private key algorithm, and they share the private key. All communications are now encrypted and decrypted using a shared secret key.
• the client encrypts its credentials with a secret key ...

The reason for this is twofold. First, math for public-key cryptography is much more expensive than math for a private key. The idea is to do this expensive math only once to share a common secret. Secondly, the client knows the public key of the server, but the client may not even have a public key, since the server can send him a secret message? That is why they must agree to a shared secret key.

In any case, going to your questions:

Where does the service store its private key?

On Windows, this is in the certificate store provided by the operating system. In other operating systems, I do not know.

Why do I need a certificate?

Suppose you want to buy my lawn mower with a credit card, but you are worried that I can really be a scammer. You would like to know your real name so you can pursue me if I start charging your trip to Vegas on your map.

So, when we complete the transaction, I show you a piece of paper that says: "Eric Lippert claims that the owner of this sheet of paper is Eric Lippert, signed by Eric Lippert." Do you believe me? If you already trust Eric Lippert, you do not need a piece of paper, and if you do not trust Eric Lippert, then the paper does not establish trust. This is a "self-signed certificate."

Now, if I show you a piece of paper that says: “VeriSign stated that the owner of this piece of paper is Eric Lippert, signed by VeriSign,” then the question arises: do you trust VeriSign to verify my identity? If so, then this indicates that the person you are talking to is what they call themselves.

This is the purpose of the certificate. It establishes that a particular public key is indeed associated with a particular organization, as it is signed by a third party, a trusted third party called a certification body.

When you buy something with your credit card online, you probably trust the website to make only authorized payments to this card. The certificate verifies that the public key that you are going to use for encryption is indeed the public key of this website, and not some kind of evil hacker public key.

But the public key certificate is public, so can someone grab the certificate and pretend to be a server?

Yes, but that will not help them unless they steal a private key that is private. A person with a different certificate cannot decrypt messages encrypted with the public key, so they will not be able to exchange the secret key with the client! Even if they manage to trick the client, all they are going to get is a bit stream encoded by the client’s secret key, a secret key that an attacker cannot get without the private half of the certificate.

This means: if I allow access to my private key, someone can impersonate me, right?

Yes. The security of the entire system depends on the private key remaining private. That is why it is called a private key. If an attacker gains access to your private key, they can impersonate you at their discretion, so keep it secret, keep it safe. If your key is cracked, there is a mechanism by which the certificate can be revoked, but the damage will usually be done.

Answer 2

Eric Lippert's answer is great, but I thought I'd add a few details in response to a couple of points:

• This does not make sense to me, because at first I know the IP address of my service on my local network (I know who this service is)

Yes, it’s true that the SSL server authentication is correct, it may not be of much benefit if you are located inside and inside the country or in a reliable secure LAN. However, SSL or more correctly TLS (Transport Layer Security) provides you with an encrypted channel for exchanging data between your client and server. This means that if any of your client and server sniffs at the network, they will not be able to read the message. TLS (SSL) is the most supported and easiest way to achieve this.

• If I use an SSL certificate, and someone has access to a computer that suits the service, can he somehow get the private key, are the connections insecure?

If someone has administrator access to the server where the private key is stored (in the certificate), and this person has malicious intentions, then, frankly, you have lost a lot of time before that. When storing certificates in the certificate store, you can set special permissions on who can read, write, and modify the certificate.

Hope this helps.