3 ms·
Shouldn't Perfect Forward Secrecy protect against exactly this kind of scenario where the server's primary keys are compromised?
by this_user 13y ago
Shouldn't Perfect Forward Secrecy protect against exactly this kind of scenario where the server's primary keys are compromised?
- makomk 13y agoIt does, assuming you don't have any way to extract the session keys from server RAM - which is kind of the problem here.
- this_user 13y agoI was thinking of the scenario of old traffic being recorded by someone. Unless they also extracted the session key at that time, that traffic should be secure if PFC was enabled even if someone where to extract the server key now.
- ivanr 13y agoYes, but there are other ways to compromise TLS sessions. For example, if you're using session tickets, the ticket key could be in RAM. Or, the session master keys themselves could be leaked. Still, you're _much_ better off with Forward Secrecy -- in most cases keys ticket keys are rotated with server restarts; so are session master keys.