4 ms·

The other advantage of running your own PKI is you can intercept and decrypt arbitrary traffic on the network.

sneak 3y ago
No. Knowledge of the CA private key does not allow for this. In all cases you have the webserver's private key, whether you issue the cert yourself or if someone else does. If you have the web server's private key, you can decrypt the traffic, but only if PFS ciphers are not used. It is a common misconception that knowledge of CA keys allows you to decrypt traffic. It does not. It allows you to issue valid certificates. It's only used for signing. It's the webserver's key that protects the traffic. The webserver's operator has that key regardless of who the CA is. In the case of PFS cipher suites (eg EDH) an ephemeral key is used for confidentiality and the endpoint keys are just used for integrity and key authentication. Even with the webserver key you aren't decrypting those streams. In no case does the CA private key help you decrypt traffic.
- ivlad 3y ago
  > Knowledge of the CA private key does not allow for this Of course it does. You just generate certificates for every TLS handshake you see and MitM them. And yes, it works for PFS too. There is no difference for MitM. > In the case of PFS cipher suites (eg EDH) an ephemeral key is used for confidentiality and the endpoint keys are just used for integrity and key authentication. Even with the webserver key you aren't decrypting those streams. You never encrypt data with a key from certificate, even without PFS. That would be too slow. You generate a pre-master key and then use it to generate keys for symmetric algorithms, like AES or Chacha20, that are actually used for data stream encryption. The only difference between PFS and non-PFS is that in the former case pre-master is generated using some form of DH, with promise of keys being destroyed after some time, and in the later case, client just generates a random key, encrypts it with the public key and sends it to the server.
  - sneak 3y ago
    MitM is not "intercept and decrypt arbitrary traffic on the network" which is what was asserted. You are describing an active attack, while fiddlerwoaroof was discussing a passive one.
    - fiddlerwoaroof 3y ago
      I wasn’t distinguishing the two sorts of attacks.

No. Knowledge of the CA private key does not allow for this. In all cases you have the webserver's private key, whether you issue the cert yourself or if someone else does. If you have the web server's private key, you can decrypt the traffic, but only if PFS ciphers are not used. It is a common misconception that knowledge of CA keys allows you to decrypt traffic. It does not. It allows you to issue valid certificates. It's only used for signing. It's the webserver's key that protects the traffic. The webserver's operator has that key regardless of who the CA is. In the case of PFS cipher suites (eg EDH) an ephemeral key is used for confidentiality and the endpoint keys are just used for integrity and key authentication. Even with the webserver key you aren't decrypting those streams. In no case does the CA private key help you decrypt traffic.

ivlad 3y ago
> Knowledge of the CA private key does not allow for this Of course it does. You just generate certificates for every TLS handshake you see and MitM them. And yes, it works for PFS too. There is no difference for MitM. > In the case of PFS cipher suites (eg EDH) an ephemeral key is used for confidentiality and the endpoint keys are just used for integrity and key authentication. Even with the webserver key you aren't decrypting those streams. You never encrypt data with a key from certificate, even without PFS. That would be too slow. You generate a pre-master key and then use it to generate keys for symmetric algorithms, like AES or Chacha20, that are actually used for data stream encryption. The only difference between PFS and non-PFS is that in the former case pre-master is generated using some form of DH, with promise of keys being destroyed after some time, and in the later case, client just generates a random key, encrypts it with the public key and sends it to the server.
- sneak 3y ago
  MitM is not "intercept and decrypt arbitrary traffic on the network" which is what was asserted. You are describing an active attack, while fiddlerwoaroof was discussing a passive one.
  - fiddlerwoaroof 3y ago
    I wasn’t distinguishing the two sorts of attacks.