4 ms·

This article seems to start out with wrong assumptions and therefore ends up presenting dangerously wrong conclusions: "Suppose, for example, the NSA was recor

This article seems to start out with wrong assumptions and therefore ends up presenting dangerously wrong conclusions: "Suppose, for example, the NSA was recording all HTTPS encrypted traffic to/from joeswebsite.com in January. Then, in February, they learned the private key for joeswebsite.com. Almost always, that lets them decrypt everything from January, February, March and beyond." We should instead suppose that the NSA has had the private keys all the time (since it started recording encrypted communication), so every piece of communication that has been recorded can be decrypted even with Perfect Forward Secrecy. I.e. let's assume they got Google's private key immediately when it was last changed, then all communication with Google's servers is decryptable (correct me if I'm wrong). The NSA doesn't have to brute-force private keys, they just use legal/strong-arm techniques to obtain them, so it doesn't take a lot of computing power and time.

Scaevolus 13y ago
No. The point of Perfect Forward Secrecy is that, even if you know one side's private key and have a log of all communications, you cannot determine what _session-key_ was agreed upon, and thus can't decrypt the rest of the session. PFS means that even with private keys, you can't read sessions passively. Of course, it can't help with a MITM or taps on unencrypted data.
- methehack 13y ago
  I guess this is exactly why this is over my head. Maybe you can help me even though it's a little unfair to pick on you :) If one can decrypt the conversation that negotiates the session key and thereby obtain the session key, couldn't one also read the conversation? This must be the whole trick to the ephemeral part...
  - tdg 13y ago
    This is not PFS but a simplified example of how you may not be able to decrypt a conversation with one side's private key: Server X and User Y are communicating. Some guy Z has X's private key. Z is also passively listening the communication. - Y sends its public key to X. X sends its public key. - Y generates a random number (A), encrypts with X's public key sends to X. - Both X and Z decrypt the number. Now X, Y and Z all know the number A. - X generates a random number (B), encrypts with Y's public key, sends to Y. - Since Z does not have Y's private key, it can't decrypt it . At this point, X and Y know A and B, Z only knows A. - X and Y use a predetermined algorithm using A and B as inputs to generate a new key. Further communications are encrypted/decrypted with this key. - Z can't decrypt the communication.
    - methehack 13y ago
      Excellent explanation! I'm in!
    - GhotiFish 13y ago
      Great explanation of the concept! That's really clear.
    - methehack 13y ago
      And to link it back to the outer conversation... Since google is using PFS for gmail, for the NSA to read those conversations, google would either need to (a) give them the email unencrypted directly (cheating) or (b) give them the specific key negotiated for each conversation. It strikes me that once PFS is in place, google would, in theory, be able to keep everything private except those conversations that a court forced them to give up the keys for. As long as the rule of law were upheld (i.e., warrants/judicial involvement), it seems to me that this model could work and be generalizable for all web traffic. Maybe it's the way forward... Happy to have my naiveté corrected :)
deleted 13y ago
[deleted]
peter487 13y ago
Yes you are wrong :D If NSA is not actively man-in-the-middling you, Perfect forward secrecy still works. ECDHE has been in Openssl since version 1.0.0 so its out there just not used. Btw. Is there any addon for Firefox that shows the “encrypted communication” details like google does?
- sliverstorm 13y ago
  They don't have to take an active role though if they just sniff all the traffic, right?
  - cturner 13y ago
    They won't have access to the temporary keypair that the server generates, and which lives only on the server.
  - tptacek 13y ago
    Yes, they do.
    - sliverstorm 13y ago
      Whoops. This wouldn't be the first time I got public/private key schemes muddled in my head.
- lazyjones 13y ago
  > Yes you are wrong :D If NSA is not actively man-in-the-middling you, Perfect forward secrecy still works. OK, I guess I was reading too much into the (not very enlightening) definition of PFS on Wikipedia and too little of the actual implementation based on Diffie-Hellman, which has the desired properties. The question that arises is: how feasible is a MITM attack on this phase of session initiation? Can it be kept undetected?
  - tonfa 13y ago
    With channel id, it would need to share the state even as laptops move across networks.

Scaevolus 13y ago

No. The point of Perfect Forward Secrecy is that, even if you know one side's private key and have a log of all communications, you cannot determine what _session-key_ was agreed upon, and thus can't decrypt the rest of the session. PFS means that even with private keys, you can't read sessions passively. Of course, it can't help with a MITM or taps on unencrypted data.

methehack 13y ago
I guess this is exactly why this is over my head. Maybe you can help me even though it's a little unfair to pick on you :) If one can decrypt the conversation that negotiates the session key and thereby obtain the session key, couldn't one also read the conversation? This must be the whole trick to the ephemeral part...
- tdg 13y ago
  This is not PFS but a simplified example of how you may not be able to decrypt a conversation with one side's private key: Server X and User Y are communicating. Some guy Z has X's private key. Z is also passively listening the communication. - Y sends its public key to X. X sends its public key. - Y generates a random number (A), encrypts with X's public key sends to X. - Both X and Z decrypt the number. Now X, Y and Z all know the number A. - X generates a random number (B), encrypts with Y's public key, sends to Y. - Since Z does not have Y's private key, it can't decrypt it . At this point, X and Y know A and B, Z only knows A. - X and Y use a predetermined algorithm using A and B as inputs to generate a new key. Further communications are encrypted/decrypted with this key. - Z can't decrypt the communication.
  - methehack 13y ago
    Excellent explanation! I'm in!
  - GhotiFish 13y ago
    Great explanation of the concept! That's really clear.
  - methehack 13y ago
    And to link it back to the outer conversation... Since google is using PFS for gmail, for the NSA to read those conversations, google would either need to (a) give them the email unencrypted directly (cheating) or (b) give them the specific key negotiated for each conversation. It strikes me that once PFS is in place, google would, in theory, be able to keep everything private except those conversations that a court forced them to give up the keys for. As long as the rule of law were upheld (i.e., warrants/judicial involvement), it seems to me that this model could work and be generalizable for all web traffic. Maybe it's the way forward... Happy to have my naiveté corrected :)

deleted 13y ago

[deleted]

peter487 13y ago

Yes you are wrong :D If NSA is not actively man-in-the-middling you, Perfect forward secrecy still works. ECDHE has been in Openssl since version 1.0.0 so its out there just not used. Btw. Is there any addon for Firefox that shows the “encrypted communication” details like google does?

sliverstorm 13y ago
They don't have to take an active role though if they just sniff all the traffic, right?
- cturner 13y ago
  They won't have access to the temporary keypair that the server generates, and which lives only on the server.
- tptacek 13y ago
  Yes, they do.
  - sliverstorm 13y ago
    Whoops. This wouldn't be the first time I got public/private key schemes muddled in my head.
lazyjones 13y ago
> Yes you are wrong :D If NSA is not actively man-in-the-middling you, Perfect forward secrecy still works. OK, I guess I was reading too much into the (not very enlightening) definition of PFS on Wikipedia and too little of the actual implementation based on Diffie-Hellman, which has the desired properties. The question that arises is: how feasible is a MITM attack on this phase of session initiation? Can it be kept undetected?
- tonfa 13y ago
  With channel id, it would need to share the state even as laptops move across networks.