4 ms·
Misses the point. The concern is all historic traffic being vulnerable to a single encryption failure. Short cert lives make certain decloaking much, kuch more
by waheoo 6y ago
Misses the point. The concern is all historic traffic being vulnerable to a single encryption failure.
Short cert lives make certain decloaking much, kuch more difficult.
- gpm 6y agoIt looks like 84% of sites [1] use forward security with modern browsers, which should mean historic traffic is not vulnerable to a leaked key. It seems like driving this number up is a better way of dealing with historic traffic than quickly expiring certs. Limiting the duration of leaks of future traffic seems like the right justification for short lived certs. [1] https://www.ssllabs.com/ssl-pulse/ https://www.ssllabs.com/ssl-pulse/
- tialaramex 6y agoHowever in TLS 1.2 and earlier in most cases there is also a potentially long-lived key inside the server to enable faster (1-RTT) resumption. Bad guys who obtain this key get to decrypt all TLS sessions protected with that key, even if the client never used resumption at all. This is fixed in TLS 1.3, where having that long term key only lets you see inside subsequent resumptions that don't redo the DH key exchange. That recent GnuTLS bug resulted in bad guys not even needing to steal that resumption key for any servers using affected versions of GnuTLS because GnuTLS was just initialising it to zero...
- nyanpasu64 6y agoI heard perfect forward secrecy is intended to prevent decrypting past traffic.