8 ms·
Certificate authorities don't have private keys. A CA could give the NSA the ability to forge certificates, which would allow the NSA to engage in active man in
by MichaelSalib 13y ago
Certificate authorities don't have private keys. A CA could give the NSA the ability to forge certificates, which would allow the NSA to engage in active man in the middle attack, but that could be defeated with cert pinning.
ETA: of course CAs have their own private keys, but they don't have the private keys of their customers.
- ihsw 13y agoCertificate pinning is just another attack vector, and MS/Apple/Google may all be keeping the NSA apprised of changes to browser/device certificate policies (inadvertently or otherwise).
- MichaelSalib 13y agoWhat do you mean?
- tjohns 13y agoCare to elaborate? I don't see how publishing a list of fingerprints of trusted certs would facilitate an attack. Especially given that the underlying certificates are public knowledge, sent as part of every HTTPS session.
- jiggy2011 13y agoIf CAs don't have private keys , how are they signing certificates?
- blibble 13y agoyou transmit your public key, identity and server information. the CA then verifies your identity, and then produces a certificate by signing (using their private key) the message digest of the concatenation of: - certificate information: server name/organisation/country/... (the "subject"), start date, end date, etc - your public key - the subject of their certificate your private key should never leave your system.
- jiggy2011 13y agoRight, but the CA in that scenario has their own private key. If the private key for say Verisign was shared with the NSA, then the NSA would be able to MITM anybody using a cert that appeared to come from verisgn.
- blibble 13y agothey wouldn't share their key, the complicit CA would generate a certificate for a key generated by the NSA with the CA capability bit enabled. the NSA could then can use that to MITM sites without explicit pinning.
- jiggy2011 13y agoIf they NSA could coerce a CA into sharing the key, they could make less detectable MITM attacks. So when you look at the chain you see: Verisign (lol j/k really the NSA) -> Site cert Rather than: Verisign -> Third party CA (suspicious) -> Site cert If you pinned the site certs you should be able to defeat both of these.
- 23david 13y agowhy couldn't they coerce all CA's into sharing the keys?
- antocv 13y agoThey can and they most probably have done that. Even Iran and China did it, stole root CA private keys, kind of sloppy because we know. Coercion by legal means, moles or good old hacking or planting bugged hardware in the targets system and extracting private keys. Its within the realms of NSA, remember, they have the capability to make their own processors.
- nivla 13y agoThe CA doesn't have/or need your private key. It works by signing your public key with its private key, thus affirming that you are whom you say you are. Think of it as getting a recommendation letter from your professor with his signature. Public and Private keys are also cryptographically related to each other, so a change in one will affect the other.
- jiggy2011 13y agoI mean , they do have their own private keys. So anyone with access to a CA's private key can pretend that they are that CA.
- marcosdumay 13y agoYes, but they can't pretend that they are the company you are talking to... Or at least they'll leak enough information to get caught if they do that in a massive way.
- jiggy2011 13y agoThey can if they simply sign a cert that is identical in all but public key.
- stygiansonic 13y agoCAs do have private keys. Otherwise, what is the public key that I see on the Entrust Root CA related to? (The CA at the root of the hierarchy that issued HN's certificate) But you're correct that even if the NSA got the CA's private key, they could only "forge" certificates and this would be detected by certificate pinning. (Similar to the Comodo/Digitnotar compromises)
- Ihmahr 13y agoSo if my entire website goes over ssl, could they still read or alter the secret content if they mitm by forging a certificate if the certificate is not pinned? Could they for example present a generic login and then mitm from thereon? EDIT: Maybe ip traffic would reveal this. But what if they were to target an individual? I'm just trying to get to the bottom of this.
- MichaelSalib 13y agoFor a small website, sure. But it would be noticeable at the origin if you knew what to look for: all of the sudden your usual distribution of client IPs would be replace by a much smaller set of NSA IPs. And there's no way they could scale it up to deal with google or facebook. They'd have to put start buying dozens of datacenters around the world and a vast amount of bandwidth. And they'd need to be able to hijack an enormous amount of traffic. Honestly, it seems like buying up zero-day exploits and putting malware on people's computers would be oh so much easier and much much cheaper.
- duskwuff 13y ago> But it would be noticeable at the origin if you knew what to look for: all of the sudden your usual distribution of client IPs would be replace by a much smaller set of NSA IPs. That's not a safe assumption. Given that this is the NSA we're talking about, it's probably within their capabilities to transparently MITM all connections to your server.
- MichaelSalib 13y agoSure, if we're talking about a small number of users. But this isn't going to scale and it doesn't seem very cost effective.
- MichaelSalib 13y agoIf the federal government deploys its full weight against you, there's really not much you can do. Directed against one individual, then sure, an active MITM attack is feasible if you don't have cert pinning. I doubt it is cost effective though when compared to just filing a national security letter with the companies you're communicating with or putting malware on your box or installing a keylogger or just plain locking you in a room and beating you with a rubber hose until you tell them what they want to hear.