MC wrote:
> Additional note: with a compromised server certificate, you have an
> authentication problem only. A different site can successfully identify
> itself as the original owner. It does not mean the encryption is at risk
> to be sniffed out as that is still done against the client's keys.

That's not the way I read the standard
(http://developer.mozilla.org/en/docs...uction_to_SSL). The client
creates a premaster session key for encryption and encrypts this key
using the server's public key. The server decrypts the the premaster
session key with his private key. Then both the client and server use
the premaster key to generate the same list of session keys. So if you
have the server's private key then you can decrypt the premaster and
create all the session keys for the session. With that you can decrypt
the session just as fast as it occurred on the wire.

The client's and the server's public/private keys are only used to
authenticate and do key exchange. The session encryption uses the
agreed upon symmetric encryption algorithm.

dMn