4 ms·

removed

• openasocket 9y ago
  It sounds like you're implying you are aware of a vulnerability in the TLS 1.2 protocol or in a major TLS 1.2 implementation. If you do, please responsibly disclose this to the maintainers immediately so it can be fixed. Moreover, you seem to be implying that major enterprises and/or governments are aware of this vulnerability, and will use/are using it to identify leakers. Generally forward security doesn't give you a lot in a data exfiltration scenario. In this scenario a user is in a hostile network and their machine may be partially compromised and they need to upload data to a friendly server. If the friendly server uses non-PFS cryptography, like static DH, anyone with the server's private key can decrypt the traffic. But if the adversary has the secret keys of your friendly server it's already game over. The advantage forward security gives you is that each individual connection will have a different ephemeral key, so you can't steal the server's keys to decrypt the traffic offline, and if you can break the ciphersuite you have to do so for each and every connection. I personally think we should keep non-PFS ciphersuites out of TLS 1.3, but I don't think it's at all fair to assume malice on the part of those arguing to allow it