3

Would there be any benefit at all to encrypting a message using PGP before sending it to a REST server over SSL, or is this completely redundant and a waste of processing time?

For example, could a server's SSL be set up so poorly that an intruder could sniff the packets and read the messages in plaintext - at which point encrypting the messages with PGP would provide a safe guard to this?

I ask because I started playing around with a python socket server, in which I was encrypting all messages with PGP, but now want to do it over a REST server instead, and realized I would be doing this over SSL anyways.

  • Why assuming SSL is setup poorly, you're not in control of that? Also, is the message supposed to be for a (human) recipient, or the web app? – ndrix Mar 29 '16 at 20:56
  • @m1ke I'm making a framework that would be used by different people on their own server, so I would not be in control of the SSL. The message is supposed to be used for a web app. – Matthew Moisen Mar 29 '16 at 20:57
  • If you want to authenticate the server to which your client is communicating, SSL/TLS provides that, where PGP does not. If you are concerned with protection of the transmitted data at rest, on the server side, then PGP provides that, but SSL/TLS does not (it only provides protection of the message in motion. – Castaglia Mar 29 '16 at 21:32
  • See also Is SSL secure enough for a REST API – gowenfawr Mar 30 '16 at 11:54
2

No, PGP is not needed if SSL is setup correctly. Of course, it will "add more security", but the benefit doesn't outweigh the hassle of creating it.

If a malicious agent in between would be able to decrypt the traffic (MITM, ...), you could also wonder if somebody would be able to access your web application's environment and use the private key of your generated keypair to decrypt traffic.

If you wish to have your connection authenticated as well, you can always issue client side certificates, and perform mutual authentication; this will give you data confidentiality and integrity. And is a lot easier than implementing PGP in a web client/app.

  • When you say "If a malicious agent in between would be able to decrypt the traffic (MITM, ...), you could also wonder if somebody would be able to access your web application's environment and use the private key of your generated keypair to decrypt traffic.", do you mean to say that if the malcious agent can decrypt the SSL traffic, it is because he has already compromised the private SSL key, which would strongly imply that he already has access to the web application's environment, and would therefore likely have compromised the GPG private key also? – Matthew Moisen Mar 29 '16 at 22:58
  • Oh no, not at all. It's possible to perform a man-in-the-middle, just like Burp suite does it, by trusting a arbitrary CA certificate. This allows that party to issue certificates, and decrypt (and re-encrypt) all SSL traffic. This doesn't mean that the same person/organization (think agency, proxy admin, wifi, ...) has access to your environment. If you do ever send any secrets (i.e symmetric keys, secret keys, pw's) over SSL, then they will see it. – ndrix Mar 29 '16 at 23:07
1

Yes, but not primarily from the aspect of the traffic being sniffed. If the REST server stores your PGP encrypted data temporarily then that data is subsequently "pulled not pushed" to a more secure server in a more secure area (possibly behind a firewall that doesn't allow inbound connections from the less secure server). The data could then be decrypted on a server which allows no connections in or out to the Internet (or whatever other network you are concerned about). This architecture would radically reduce the attack surface related to the system where the data is stored (As opposed to the decrypted data being on a system directly connected to the Internet). This is especially useful if both sides of the communication are disciplined about implementing this same process on both sides.

Basically it can be viewed as an extra layer of defense-in-depth "if" implemented correctly. Note: this also serves as an extra layer of defense-in-depth during the transmission process as well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.