How do certificate avoid the man in the middle attack?

Question

I have another question to security in the web. If I understand it correctly certificates are for identify who you really are. So the man in the middle attack isn't possible. But when I see this image:

http://upload.wikimedia.org/wikipedia/commons/thumb/2/2b/Digital_Signature_diagram.svg/800px-Digital_Signature_diagram.svg.png

I think a man in the middle attack is possible. You could split the Signature, the certificate from the data. Make your own signature with your fake data and send the fake data with the fake signature (but the right certificate) to the server/client.

What I also not understand in this picture is where the certificate gets checked, on the verification side.

thanks.

SCBoy

Answer 1

Make your own signature with your fake data and send the fake data with the fake signature (but the right certificate) to the server/client.

The problem is that the receiver will then look at the fake signature and see that it does not match the certificate of the real sender.

You can only create signatures that match a given certificate when you have the correct private key for that certificate (even though the certificate itself is public, that is the magic of asymmetric cryptography). This private key is being kept secret by the owner of the certificate (the original sender of the message).

The man-in-the-middle is prevented by distributing trusted certificates in advance. You have to trust the authenticity of the certificates, either by trusting them directly (root certificates) or by trusting a chain of signatures on the certificate leading up to one that you trust.

If the man in the middle can make you believe that his fake certificate is the real deal, then the whole system fails.