How is SSL tunneling secure?
I've been reading about SSL tunnels and there seems to be a pretty important point I don't seem to understand. Once the tunnel is in place and the encrypted data is flowing between the two endpoints I understand how the proxy in the middle simply forwards the packets and cannot see what is contained in them.
However, in order to get to this stage, an SSL handshake had to have taken place through the proxy. Couldn't the proxy have listened in on that exchange in order to gain the necessary information to decode the data as it was sent through the tunnel? In other words, can I create an SSL tunnel through a completely untrusted proxy with any kind of assurance that my data can't be read? From what I've seen, I believe that the answer is yes, but I can't see how this is possible.
Can anyone shed some light?
Sander Smith
