0

We're doing a PoC on a new API Security/WAF tool, and we're planning to place this solution out-of-ban rather than inline. So traffic wont go through the solution and we'll send the mirrored traffic to analyze in the new solution.

My question is, should these solutions have the capability to decyrpt ssl when i send the mirrored https traffic to it? Is it possible to decrypt mirrored https traffic?

And what are the advantages and disadvantages of inline and out-of-band architectures?

1 Answer 1

2

Since out of band analysis can not manipulate the traffic to create an active man in the middle attack, it would need to have access to the keys of the existing TLS connection. But every TLS connection is protected by a unique key, which is generated during key exchange in the TLS handshake.

With RSA key exchange the necessary key material could be extracted from the handshake if the analysis system had access to the certificate and matching private key. This was often the case in out of band or passive analysis in the past, when the analysis system run in the same responsibility as the system it should protect (i.e. server side WAF, IDS, ...).

But RSA key exchange is long obsolete since it does not provide forward secrecy. It is no longer available in TLS 1.3 at all. So this is no longer an option.

Thus the current way for passive analysis is to somehow share the session key material from the server to the analysis system. This requires changes to the server to export the key material in real time and then some way to transfer this key material to the analysis system. There are several solutions on the market which offer this - see NIST Special Publication 1800-37B - Addressing Visibility Challenges with TLS 1.3 within the Enterprise Volume B.

When comparing such passive analysis using live key extraction with the more common TLS terminating reverse proxy approach, it is obvious that first needs changes to the server and the latter does not. This makes such passive analysis only usable in situations where the server software is supported for key extraction by the vendor of the analysis solution.

The advantage of the passive analysis is that there is still an end-to-end TLS connection between client and server, contrary to client-to-WAF TLS only in case of a TLS terminating WAF reverse proxy in front of the server. This also means can deal directly with client certificates, which would not be possible with some TLS terminating WAF in between (these usually forward the client certificate in some special HTTP header to the server). But, while it is end-to-end TLS it still isn't as secure as "real" end-to-end TLS because the encryption key is shared with the analysis system.

And of course only the "inline" WAF can not only analyze the traffic but also change it, like sanitizing or rejecting requests. This offers better protection than just looking at the traffic and generating alerts.

5
  • Ok so in order to passively analyse the https traffic, changes must be made on the server right? Otherwise there is no way to decyrpt and analyze the copy of the actual traffic, am i correct?
    – Sjomann
    Commented Apr 17 at 14:09
  • and another question, can i get the same amount of results from in-line and out-of-band analysis? I'm not talking about the actions i can take like altering or rejecting a request. I know I need in-line implementation for that, but can I get all the information from a request in out-of-band option like I can get with in-line?
    – Sjomann
    Commented Apr 17 at 14:27
  • @Sjomann: Passive analysis needs the original key material which needs to be extracted in real-time from the server (including which connection it is associated with). This usually means modifications to the server, since this is not a commonly supported feature. With this key material one then can decrypt everything, i.e. no information lost. Commented Apr 17 at 14:34
  • ok thank you very much. I guess I just want to clarify a key point. What is the difference between an inline and out-of-band solution, analysis wise? Because a vendor says we can get more information with in-line implementation, with out-of-band option, we can't see the response itself, just the response code. thanks
    – Sjomann
    Commented Apr 17 at 15:06
  • @Sjomann: I have no idea what this vendor is talking about. Sounds more like a limitation of their product, not of the concept. But too few details to judge. Commented Apr 17 at 15:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .