3 ms·
Being able to decrypt just by loading the cert keys is a whole lot easier (edit: this is what TLS 1.2 allows). It'll work across vendors, products, it'll work g
by MichaelGG 9y ago
Being able to decrypt just by loading the cert keys is a whole lot easier (edit: this is what TLS 1.2 allows). It'll work across vendors, products, it'll work generically, without having to deal with getting session keys out in whatever format a product supports. It'll work when there is no session-key support, like everything that just uses a TLS library as an opaque TCP++ channel, i.e., nearly everything made.
Yeah we'd be better off focusing efforts on creating easy, standardized, ways of doing plaintext logging.
- revelation 9y agoYeah it's even easier if we just enable the "none" cipher again. That doesn't make it a sensible choice. What despicable thinking to suggest we should break the protocol so ethically dubious interception companies can reuse their implementation from 1999.
- iancarroll 9y agoYou cannot passively decrypt connections that use PFS, even with the certificate key. And TLS 1.3 mandates PFS.