Defending against private key leaks such as those enabled by Heartbleed

Question

More and more evidence seems to be surfacing that the Heartbleed vulnerability leaks the private key portion of the SSL certificate in use.

As such this can actually mean that if an attacker was also able to passively monitor SSL traffic, when they get hold of this key, they could decrypt an unlimited log of SSL data, potentially accessing thousands of user's sensitive data.

But I had thought that such implementations as Perfect Forward Secrecy were supposed to defend against this by utilising a symmetric key that meant the revealing of the SSL private key would still be insufficient to decrypt recorded SSL traffic?

How widespread is the use of Perfect Forward Secrecy and if not-so, is this trivial to setup in an HTTPS context?

Answer 1

PFS does, in fact, prevent reading the log files after-the-fact. The only use for a captured private key in a PFS arrangement is impersonation. You can't use it for passive snooping in any context, either after-the-fact or indeed live.

This is because in a PFS configuration, the ephermal session key is generated using Diffie-Hellman between the two parties rather than being simply delivered as part of the handshake. And since with a DH key negotiation, the generated key cannot be derived by an observer, the certificate key is of no use to an eavesdropper.

But if the adversary instead inserts himself as a man-in-the-middle, impersonating the server, then the D-H negotiation happens with the adversary instead of the true server. In that case, the adversary gets the ephemeral key and can decrypt the conversation as it happens ... and indeed must participate in the conversation, either relaying messages to the true server, or simply posing as the server on his own.