Secure session capability using public-key cryptography without access to the private key
A first server receives a set of cryptographic parameters from a second server. The set of cryptographic parameters is received from the second server as part of a secure session establishment between a client device and the second server. The first server accesses a private key that is not stored on the second server. The first server signs the set of cryptographic parameters using the private key. The first server transmits the signed set of cryptographic parameters to the second server. The first server receives, from the second server, a request to generate a premaster secret using a value generated by the second server that is included in the request and generates the premaster secret. The first server transmits the premaster secret to the second server for use in the secure session establishment between the client device and the second server.
1. A method in a first server, comprising the first server performing the following:
participating in a first secure session establishment procedure that establishes a first secure session between the first server and a second server;
receiving a set of cryptographic parameters from the second server over the first secure session, wherein the set of cryptographic parameters is received from the second server as part of a second secure session establishment of a second secure session between a client device and the second server;
signing the set of cryptographic parameters using a private key that is available on the first server and not stored on the second server;
transmitting the signed set of cryptographic parameters to the second server over the first secure session;
receiving, from the second server over the first secure session, a request to generate a premaster secret using a value generated by the second server that is included in the request;
generating the premaster secret using the value generated by the second server that is included in the request; and
transmitting the premaster secret to the second server over the first secure session for use in the second secure session establishment between the client device and the second server.
2. The method of claim 1 , wherein as part of participating in the establishment of the first secure session between the first server and the second server, the first server performs the following:
requesting a certificate from the second server;
receiving the certificate from the second server; and
using the received certificate to authenticate the second server.
3. The method of claim 1 , further comprising the first server receiving, from the second server, an indication of a domain in which the client device is attempting to connect via the second secure session, and wherein the private key corresponds to a public key associated with the indicated domain.
4. The method of claim 1 , wherein prior to transmitting the set of cryptographic parameters to the second server, the first server verifying that the second server is communicating with the first server with an IP address having a value expected by the first server.
5. The method of claim 1 , wherein the second secure session establishment between the client device and the second server uses a Diffie-Hellman key exchange mechanism.
6. An apparatus, comprising:
a first server to include a set of one or more processors and a set of one or more non-transitory computer-readable storage mediums that is to store instructions, that when executed by the set of processors, cause the set of processors to perform the following operations:
participate in a secure session establishment procedure that establishes a first secure session between the first server and a second server;
receive a set of cryptographic parameters from the second server over the first secure session, wherein the set of cryptographic parameters is to be received from the second server as part of a second secure session establishment of a second secure session between a client device and the second server;
sign the set of cryptographic parameters using a private key that is available on the first server and not stored on the second server;
transmit the signed set of cryptographic parameters to the second server over the first secure session;
receive, from the second server over the first secure session, a request to generate a premaster secret using a value generated by the second server that is included in the request;
generate the premaster secret using the value generated by the second server that is included in the request; and
transmit the premaster secret to the second server over the first secure session for use in the secure session establishment between the client device and the second server.
7. The apparatus of claim 6 , wherein as part of participation in the establishment of the first secure session between the first server and the second server, the first server is to perform the following:
request a certificate from the second server;
receive the certificate from the second server; and
use the received certificate to authenticate the second server.
8. The apparatus of claim 6 , wherein the set of one or more non-transitory computer-readable storage mediums further is to store instructions, that when executed by the set of processors, cause the set of processors to perform the following operations:
receive, from the second server, an indication of a domain in which the client device is attempting to connect via the second secure session, and wherein the private key is to correspond to a public key associated with the indicated domain.
9. The apparatus of claim 6 , wherein the set of one or more non-transitory computer-readable storage mediums further is to store instructions, that when executed by the set of processors, cause the set of processors to perform the following operation:
prior to transmission of the set of cryptographic parameters to the second server, verify that the second server is communicating with the first server with an IP address having a value expected by the first server.
10. The apparatus of claim 6 , wherein the second secure session establishment between the client device and the second server is to use a Diffie-Hellman key exchange mechanism.
11. A non-transitory machine-readable storage medium that provides instructions that, when executed by a processor of a first server, causes said processor to perform operations comprising:
participating in a first secure session establishment procedure that establishes a first secure session between the first server and a second server;
receiving a set of cryptographic parameters from the second server over the first secure session, wherein the set of cryptographic parameters is received from the second server as part of a second secure session establishment of a second secure session between a client device and the second server;
signing the set of cryptographic parameters using a private key that is available on the first server and not stored on the second server;
transmitting the signed set of cryptographic parameters to the second server over the first secure session;
receiving, from the second server over the first secure session, a request to generate a premaster secret using a value generated by the second server that is included in the request;
generating the premaster secret using the value generated by the second server that is included in the request; and
transmitting the premaster secret to the second server over the first secure session for use in the second secure session establishment between the client device and the second server.
12. The non-transitory machine-readable storage medium of claim 11 , wherein as part of participating in the establishment of the first secure session between the first server and the second server, the first server performs the following:
requesting a certificate from the second server;
receiving the certificate from the second server; and
using the received certificate to authenticate the second server.
13. The non-transitory machine-readable storage medium of claim 11 further providing instructions that, when executed by the processor, causes the processor to perform the following:
receiving, from the second server, an indication of a domain in which the client device is attempting to connect via the second secure session, and wherein the private key corresponds to a public key associated with the indicated domain.
14. The non-transitory machine-readable storage medium of claim 11 further providing instructions that, when executed by the processor, causes the processor to perform the following:
prior to transmitting the set of cryptographic parameters to the second server, the first server verifying that the second server is communicating with the first server with an IP address having a value expected by the first server.
15. The non-transitory machine-readable storage medium of claim 11 , wherein the second secure session establishment between the client device and the second server uses a Diffie-Hellman key exchange mechanism.