Answer to Question #91791 in Computer Networks for Hung

Question

Discuss why or why not.
If users A and B using HTTPS sessions to communicate with each other. Now, let we consider a case:one attacker who hasn't shared keys, a bogusTCP segment was inserted in a packet stream with {correct IP addresses,sequence numbers,TCP checksum,correct port numbers }. Does HTTPS on receiving end recognize and accept fake packets, and then pass the payload to receiving application?

Answer 1

Answer: Yes, the bogus TCP segment will be recognized by HTTPS. No, the payload is not passed to receiving application.

Explanation: Despite the correct numbers from the packet stream (IP addresses, sequence numbers, checksum, port numbers), the attacker cannot compute the MAC key which is agreed in advance by A and B for integrity purposes. Thus, when the checking is performed by HTTPS, the bogus inserted TCP segment is identified.