'Black boxes' will be installed by internet services providers to filter & decode encrypted materials – including social media and email messages, something which critics say will have an impact on personal privacy.
Rather than "bypass" encryption, they can spoof the identity of the server, so as to perform a MITM attack (effectively).
Encryption itself is only one part of the configuration when setting up an SSL/TLS connection: this ensures the confidentiality of the communication between the client and the server. Before that, the client needs to verify the identity of the server, to make sure it's exchanging data confidentially with the party it expects: this is what certificates are used for.
An X.509 certificate is issued by a CA for a given server name. If the browser trusts this CA (there are a number of trust anchors provided by default with most browsers), it can trust its content: the binding between its public key and the name it contains. The browser also has to check that the server name it was looking for is one of the names in the certificate.
What the government can do is to ask you to trust its CA certificate (and/or have the big CAs give them an intermediate CA certificate) so that they can issue certificates for their surveillance device, thereby spoofing the real server certificate. This device would be a server and decipher the connection and then act as a client itself to the real server: you would then have 2 encrypted sections: one between the client and the surveillance device, and one between that device and the real server.
There exist appliances that do this (sometimes referred to as "MITM proxy servers"), typically used on a enterprise network.
Besides the fact that anyone in control of that CA's private key could see and alter any traffic the client makes to an HTTPS site (there are a number of non-technical problems here), there are a number of technical problems when doing this at the scale of a country:
Doing all this for all HTTPS communications will certainly require a large amount of computing power and yield a substantial electricity bill.
(It's possible that the reports that led the Home Office to make such plans were drafted before Facebook switched to HTTPS for everything, by the way.)
|show 2 more comments|
They will get a CA that is in the CA root zone for all browsers to issue them valid certificates. This CA will probably be a UK based company. Spying will be completely transparent to the users. Browsers will show no warnings. This will work for a few days, until it is detected by the public at which point browser vendors will revoke the root certificate of the CA in question, like they did in the past due to security issues at a few CAs. There is no other practical way to decrypt encrypted connections, unless if someone is using very week protocols, but that is unlikely. They could also just install this boxes and then use them selectively, only target people they wish to spy on, not everyone. In this case it probably won't be detected and CA certificate will not be rejected. But you cannot monitor and decrypt all secure internet traffic and not be noticed.