TLS 1.3 is a large departure from TLS 1.2 in many ways. Relevant to this question are the fact that all TLS 1.3 ciphers provide Forward Secrecy -- which means strategies used in TLS 1.2 and prior to decrypt TLS traffic passively must change. Gone are the days of simply throwing a Private Key file on an IDS/WAF/NMS device to let it passively decrypt any TLS traffic crossing your network.
That said, for compliance reasons, Corporations will likely still require the inspection of TLS traffic crossing their networks. Which means some mechanisms for TLS decryption must continue to exist.
I can think of only two strategies which will work for TLS 1.3:
- Full proxy - terminate the TLS 1.3 sessions on the IDS/WAF/NMS and proxy the connection, inspect the clear text traffic "in between" the front-end and back-end connections.
- Exporting Session Keys - let the TLS 1.3 sessions continue to terminate on web servers (as before), but use software on the web servers which export session keys for each connection to the IDS/WAF/NMS to allow inspection of TLS traffic
Other than these two above... are there any other mechanisms that will exist to decrypt TLS 1.3 traffic?