Private Key Compromised!!! I Should Have Handled it Better...

This article focuses on a solution to ensure secure communication between the network endpoints, even if the server’s private key is compromised.

- Sanjay Phanshikar

Nowadays, almost every business is managed and developed with the help of the internet, i.e., by using web applications. Cybercrimes have increased over time and web application hacking has become very common. This is the reason why a lot of effort is put into ensuring the security of these web applications.

Encryption of communication is an obvious security mechanism, as it protects its confidentiality when in transit. This article assumes you know the basics and the terminology for:

 ● Asymmetric encryption

 ● Symmetric encryption

 ● Web communication

For web applications, secure communication happens when every message is encrypted, which we call HTTPS. Figure 1 gives the schematic representation of how this happens between the server and the client.

It is clear from Figure 1 that secure communication is done by encrypting the communication using a symmetric key [KSymm]. To exchange the symmetric key between end points, asymmetric key encryption is used [KPub and KPriv]. This scheme is less likely to break, as only the server has a private key with it.

Figure 1: Basics of communication between a web application and the browser

What if a private key is compromised?