4 ms·

In modern times, the keys on a SSL certificate don't directly encrypt the session key used to protect communications between your browser and web-server. Inste

In modern times, the keys on a SSL certificate don't directly encrypt the session key used to protect communications between your browser and web-server. Instead the key only signs the diffie-helman share that a web server uses. Web-server operators are free to use 25519 for their ECDH shares if they want to, the curve used there does not have to match the certificate's curve. Even if the NIST curves are backdoored, the backdoor wouldn't be able to passively decrypt TLS sessions. At best it might allow someone with knowledge of the backdoor to impersonate a web-server, but that's an active attack and it would be very risky for the attacker. They'd run a huge risk of disclosing their back door capability.

coder543 6y ago
Can you link to a config example for nginx for what you’re describing in your first paragraph? Or a web framework in any language? I’ve never seen that done before, where the DH shares don’t match the certificate type. But, I’m definitely not an expert on the low level details of TLS.
- wolf550e 6y ago
  All your DH shares don't match the certificate type already because you use ECDH with either NIST P-256 or X25519 and you likely use an RSA certificate. The two asymmetric systems (one for key exchange and one for authentication) have nothing to do with each other, you can mix and match them freely (e.g. post-quantum key exchange experiments ran by google and cloudflare). The nginx config to specify the curve (using its openssl name) is this: https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ecdh_curve https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_...
tlb 6y ago
Active attacks are effective and not that risky. For most web services, the attacker only needs to intercept a single transaction in order to get the session cookies and then you are pwned. Since they only need one, they can hit you with a DNS cache poisoning attack and simultaneous clickjacking attack while you're on a public WiFi. In general, I'm skeptical of any "this attack isn't really practical" arguments. They have a way of becoming practical enough for high-value targets, so it's not something I want to use.
- tptacek 6y ago
  This feels like a trap people fall into when considering how attacks work. You're right, any one instance of active TLS interception is vanishingly unlikely to be detected. But an adversary conducting that attack at any kind of scale will be deploying instances of that attack regularly. The cost of detection can be very high --- it's not "public opprobrium", as so often seems to be the mental model on HN, but rather disclosure of sources and methods to other adversaries, who are themselves exquisitely well equipped both to detect stuff and also to work back to expand the scope of tradecraft lapses in drastic and surprising ways. Here, though, it's even simpler: you're positing an attacker who is exploiting a cryptographic vulnerability unknown to science simply in order to conduct an individual TLS interception. The consequences of the disclosure of such an attack --- one that would be discernible by amateurs --- go far beyond what curves people select in the future.
  - tlb 6y ago
    The US and a few others routinely sink billions of dollars into weapons systems they'll only ever be able to use once, like strategic nuclear submarines. So the fact that a backdoor could only be used briefly until it was discovered, doesn't mean that some agency wouldn't invest a lot of effort into developing it, just in case.
    - tptacek 6y ago
      Have you read Koblitz and Menezes on this? Section 3.1 goes into more technical details, which are worth reading and easy to follow. https://eprint.iacr.org/2015/1018.pdf https://eprint.iacr.org/2015/1018.pdf
    - deathgrips 6y ago
      The US sinks billions into strategic weapons so that it doesn't have to use them.
- temp667 6y ago
  Not that risky? This active attack is pretty easy to detect. If you fake a google cert, and chrome hits it (highly likely) game over for you.

coder543 6y ago

Can you link to a config example for nginx for what you’re describing in your first paragraph? Or a web framework in any language? I’ve never seen that done before, where the DH shares don’t match the certificate type. But, I’m definitely not an expert on the low level details of TLS.

wolf550e 6y ago
All your DH shares don't match the certificate type already because you use ECDH with either NIST P-256 or X25519 and you likely use an RSA certificate. The two asymmetric systems (one for key exchange and one for authentication) have nothing to do with each other, you can mix and match them freely (e.g. post-quantum key exchange experiments ran by google and cloudflare). The nginx config to specify the curve (using its openssl name) is this: https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ecdh_curve https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_...

tlb 6y ago

Active attacks are effective and not that risky. For most web services, the attacker only needs to intercept a single transaction in order to get the session cookies and then you are pwned. Since they only need one, they can hit you with a DNS cache poisoning attack and simultaneous clickjacking attack while you're on a public WiFi. In general, I'm skeptical of any "this attack isn't really practical" arguments. They have a way of becoming practical enough for high-value targets, so it's not something I want to use.

tptacek 6y ago
This feels like a trap people fall into when considering how attacks work. You're right, any one instance of active TLS interception is vanishingly unlikely to be detected. But an adversary conducting that attack at any kind of scale will be deploying instances of that attack regularly. The cost of detection can be very high --- it's not "public opprobrium", as so often seems to be the mental model on HN, but rather disclosure of sources and methods to other adversaries, who are themselves exquisitely well equipped both to detect stuff and also to work back to expand the scope of tradecraft lapses in drastic and surprising ways. Here, though, it's even simpler: you're positing an attacker who is exploiting a cryptographic vulnerability unknown to science simply in order to conduct an individual TLS interception. The consequences of the disclosure of such an attack --- one that would be discernible by amateurs --- go far beyond what curves people select in the future.
- tlb 6y ago
  The US and a few others routinely sink billions of dollars into weapons systems they'll only ever be able to use once, like strategic nuclear submarines. So the fact that a backdoor could only be used briefly until it was discovered, doesn't mean that some agency wouldn't invest a lot of effort into developing it, just in case.
  - tptacek 6y ago
    Have you read Koblitz and Menezes on this? Section 3.1 goes into more technical details, which are worth reading and easy to follow. https://eprint.iacr.org/2015/1018.pdf https://eprint.iacr.org/2015/1018.pdf
  - deathgrips 6y ago
    The US sinks billions into strategic weapons so that it doesn't have to use them.
temp667 6y ago
Not that risky? This active attack is pretty easy to detect. If you fake a google cert, and chrome hits it (highly likely) game over for you.