4

More and more evidence seems to be surfacing that the Heartbleed vulnerability leaks the private key portion of the SSL certificate in use.

As such this can actually mean that if an attacker was also able to passively monitor SSL traffic, when they get hold of this key, they could decrypt an unlimited log of SSL data, potentially accessing thousands of user's sensitive data.

But I had thought that such implementations as Perfect Forward Secrecy were supposed to defend against this by utilising a symmetric key that meant the revealing of the SSL private key would still be insufficient to decrypt recorded SSL traffic?

How widespread is the use of Perfect Forward Secrecy and if not-so, is this trivial to setup in an HTTPS context?

Improve this question

1 Answer 1

Reset to default
6

PFS does, in fact, prevent reading the log files after-the-fact. The only use for a captured private key in a PFS arrangement is impersonation. You can't use it for passive snooping in any context, either after-the-fact or indeed live.

This is because in a PFS configuration, the ephermal session key is generated using Diffie-Hellman between the two parties rather than being simply delivered as part of the handshake. And since with a DH key negotiation, the generated key cannot be derived by an observer, the certificate key is of no use to an eavesdropper.

But if the adversary instead inserts himself as a man-in-the-middle, impersonating the server, then the D-H negotiation happens with the adversary instead of the true server. In that case, the adversary gets the ephemeral key and can decrypt the conversation as it happens ... and indeed must participate in the conversation, either relaying messages to the true server, or simply posing as the server on his own.

Improve this answer
2
  • So even with PFS, private key exposure is still a devastating occurrence, if the attack has the ability to MITM you. Even on the wild Internet, with BGP weaknesses this is feasible, right?
    – deed02392
    Apr 12, 2014 at 8:42
  • @deed02392 it isn't an attack that can be carried out "quietly" unless the attacker is close to the victim (same coffee shop, the victim's ISP, the local oppressive government, etc). If the attacker re-routes the site traffic on the other end, it probably will be minutes (maybe even seconds) before the site owner (or their access provider) finds out and the situation escalates very quickly.
    – tylerl
    Apr 12, 2014 at 17:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .