Hacker News Reader

Comment by MichaelSalib | Hacker News Reader

Certificate authorities don't have private keys. A CA could give the NSA the ability to forge certificates, which would allow the NSA to engage in active man in the middle attack, but that could be defeated with cert pinning.

ETA: of course CAs have their own private keys, but they don't have the private keys of their customers.

View on HN

CAs do have private keys. Otherwise, what is the public key that I see on the Entrust Root CA related to? (The CA at the root of the hierarchy that issued HN's certificate)

But you're correct that even if the NSA got the CA's private key, they could only "forge" certificates and this would be detected by certificate pinning. (Similar to the Comodo/Digitnotar compromises)

So if my entire website goes over ssl, could they still read or alter the secret content if they mitm by forging a certificate if the certificate is not pinned?

Could they for example present a generic login and then mitm from thereon?

EDIT: Maybe ip traffic would reveal this. But what if they were to target an individual? I'm just trying to get to the bottom of this.

For a small website, sure. But it would be noticeable at the origin if you knew what to look for: all of the sudden your usual distribution of client IPs would be replace by a much smaller set of NSA IPs.

And there's no way they could scale it up to deal with google or facebook. They'd have to put start buying dozens of datacenters around the world and a vast amount of bandwidth. And they'd need to be able to hijack an enormous amount of traffic.

Honestly, it seems like buying up zero-day exploits and putting malware on people's computers would be oh so much easier and much much cheaper.

> But it would be noticeable at the origin if you knew what to look for: all of the sudden your usual distribution of client IPs would be replace by a much smaller set of NSA IPs.

That's not a safe assumption. Given that this is the NSA we're talking about, it's probably within their capabilities to transparently MITM all connections to your server.

Sure, if we're talking about a small number of users. But this isn't going to scale and it doesn't seem very cost effective.

If the federal government deploys its full weight against you, there's really not much you can do. Directed against one individual, then sure, an active MITM attack is feasible if you don't have cert pinning. I doubt it is cost effective though when compared to just filing a national security letter with the companies you're communicating with or putting malware on your box or installing a keylogger or just plain locking you in a room and beating you with a rubber hose until you tell them what they want to hear.

If CAs don't have private keys , how are they signing certificates?

you transmit your public key, identity and server information.

the CA then verifies your identity, and then produces a certificate by signing (using their private key) the message digest of the concatenation of:

- certificate information: server name/organisation/country/... (the "subject"), start date, end date, etc

- your public key

- the subject of their certificate

your private key should never leave your system.

Right, but the CA in that scenario has their own private key. If the private key for say Verisign was shared with the NSA, then the NSA would be able to MITM anybody using a cert that appeared to come from verisgn.

they wouldn't share their key, the complicit CA would generate a certificate for a key generated by the NSA with the CA capability bit enabled.

the NSA could then can use that to MITM sites without explicit pinning.

If they NSA could coerce a CA into sharing the key, they could make less detectable MITM attacks.

So when you look at the chain you see:

Verisign (lol j/k really the NSA) -> Site cert

Rather than:

Verisign -> Third party CA (suspicious) -> Site cert

If you pinned the site certs you should be able to defeat both of these.

why couldn't they coerce all CA's into sharing the keys?

They can and they most probably have done that. Even Iran and China did it, stole root CA private keys, kind of sloppy because we know.

Coercion by legal means, moles or good old hacking or planting bugged hardware in the targets system and extracting private keys. Its within the realms of NSA, remember, they have the capability to make their own processors.

The CA doesn't have/or need your private key. It works by signing your public key with its private key, thus affirming that you are whom you say you are. Think of it as getting a recommendation letter from your professor with his signature. Public and Private keys are also cryptographically related to each other, so a change in one will affect the other.

I mean , they do have their own private keys. So anyone with access to a CA's private key can pretend that they are that CA.

Yes, but they can't pretend that they are the company you are talking to... Or at least they'll leak enough information to get caught if they do that in a massive way.

They can if they simply sign a cert that is identical in all but public key.

Certificate pinning is just another attack vector, and MS/Apple/Google may all be keeping the NSA apprised of changes to browser/device certificate policies (inadvertently or otherwise).

What do you mean?

Care to elaborate? I don't see how publishing a list of fingerprints of trusted certs would facilitate an attack. Especially given that the underlying certificates are public knowledge, sent as part of every HTTPS session.

Reply on news.ycombinator.com