0

According to PAN-OS documentation for "Traceability and Control of Post-Quantum Cryptography",

Traffic encrypted by PQC [post-quantum computing] or hybrid PQC algorithms cannot be decrypted yet, making these algorithms vulnerable to misuse.

The implicit statement here is that non-PQC algorithms can all be decrypted now, which is awkward to say the least. But my question is in their implementation,

If SSL traffic matches an SSL Forward Proxy or SSL Inbound Inspection Decryption policy rule, the firewall prevents negotiation with PQC, hybrid PQC, and other unsupported algorithms. Specifically, the firewall removes these algorithms from the ClientHello, forcing the client to negotiate with classical algorithms. (For a list of supported cipher suites, see PAN-OS 11.1 Decryption Cipher Suites.) This enables continuous decryption and threat identification through deep packet inspection. If the client strictly negotiates PQC or hybrid PQC algorithms, the firewall drops the session. In the Decryption log for the dropped session, the error message states that the "client only supports post-quantum algorithms.” To see details of successful or unsuccessful TLS handshakes in the Decryption logs, enable both options in your Decryption policy rules.

Is it possible to use a PQC or hybrid-PQC by renegotiating the connection without a plaintext Client Hello? Client Hello is documented in RFC8446. Is there anyway to protect against PAN-OS making TLS 1.3 less secure?

1 Answer 1

2

The implicit statement here is that non-PQC algorithms can all be decrypted now, which is awkward to say the least.

No surprise here. A man in the middle can decrypt every algorithm it understands. Secrecy of the algorithm is no protection against a man in the middle, proper authentication instead is. An active TLS MITM can simply announce the algorithms it supports against the intended destination and and choose the one it supports against the client.

MITM by the firewall (or other middlebox) in corporate environment only works because the SSL intercepting proxy is explicitly trusted by rolling out such policies (adding intercepting proxy CA as trusted) to the client devices. Without this MITM would fail since the intercepted peer would not be trusted due to an untrusted certificate. In this case the communication to the intended target would simply fail because the client cannot properly authenticate the server.

Is it possible to use a PQC or hybrid-PQC by renegotiating the connection without a plaintext Client Hello? Client Hello is documented in RFC8446. Is there anyway to protect against PAN-OS making TLS 1.3 less secure?

There is Encrypted Client Hello (ECH), which is an emerging standard supported by modern browsers but not part of TLS 1.3. But the proxy could simply block connections using it, thus either failing the connection or forcing a downgrade to plain ClientHello.

Note that we are not talking about malicious attacks here, but about SSL interception in a corporate environment which is intended to increase security by analyzing even encrypted traffic and where client systems are set up to trust the company. In such environment personal opinions about being watched or not do not matter.

If your concern is instead that you want to use PQC algorithms to increase security even if you accept SSL interception, then you have to wait for the intercepting system to support these PQC algorithms. There is no inherent feature in PQC algorithms which make these impossible to use with SSL interception.

2
  • Mixed opinions on this answer, I upvoted or the pointer to ECH, but I'm not a fan of saying "done do increase security". It's done to make it possible to decrypt traffic with a quantum computer. In the capacity I operate in, intentionally making encryption more easily defeated isn't typically described as "done do increase security". Commented Apr 17 at 19:12
  • 1
    @EvanCarroll: SSL interception is a trade-off between being able to analyze the traffic for attacks and keeping end-to-end encryption for security. The decision about this trade-off are not made by normal employees, you just have to accept it if you want to work there. Commented Apr 17 at 19:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .