6

Although I understand the basic theory behind certificates and asymmetric cryptography, I'm not quite sure on the details of the X.509 protocol. I'm wondering what attacker model a given CA requires to attack the TLS/SSL traffic. Specifically, if I assume my CA to leak the private key it issued me to a third party Mallory (Mallory might also be identical to CA), can passive eavesdropping of TCP packets enable Mallory to get the plaintext? Or does Mallory need Man-In-The-Middle capabilities to read the plaintext?

My rationale for this is as follows: if the certifiacte merely enables a verified Diffie-Hellman, you have to interfere with the key exchange to be able to fool server and client into using your own key(s). But does X.509 do so?

15

CA does not issue private keys to anybody. CA signs (using its own private key, which is kept very secret) your public key. The CA has no access to your private key at all.

If the CA’s private key is leaked to Mallory, Mallory is able to issue valid certificates for any name. That means he can make almost undetectable (well, obviously, you can detect the certificate changed, but how many users check that?) man-in-the-middle attacks. But he has nothing which would help him with passive eavesdropping.

If your private key is leaked, passive eavesdropping might be possible, but in that scenario, the CA takes no part at all.

  • While all your points are interesting, I was primarily interested in what happens if my private key leaks (but I was biased against a CA who actually issues the private key, so I made the question more convoluted as it had to be). So, there is no session key exchange and the private key does give everybody who obtains it the ability to eavesdrop? – bitmask Mar 12 '15 at 13:08
  • 5
    It depends. If you use a PFS ciphersuite, you cannot decrypt the communication just by eavesdropping, even if you know the server private key. But when using RSA key exchange, you can, see e.g. this Wireshark guide to do that. – Mormegil Mar 12 '15 at 13:41
  • These are good points, but the last statement is a bit misleading, as passive eavesdropping is never possible without being in the middle of the SSL handshake. – AaronLS Mar 12 '15 at 20:11
  • 1
    @AaronLS That isn't true for RSA key exchanges. – Xander Mar 12 '15 at 21:12
  • 1
    @AaronLS SSL has RSA key exchanges as well; in fact, I'd bet that very, very, very few SSL implementations use DHE, and that almost all of them use RSA key exchange. – cpast Mar 12 '15 at 21:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.