The US government already has at least Verisign under their belt. They can already MITM just about any SSL connection they could ever want to.
I would wager that they have a large number of private keys anyway. It's not like datacenters would be able to do much when the NSA rocks up with a NSL.
Access to the master keys for a SSL/TLS session isn't like that at all. They could retroactively capture, archive, and decrypt any traffic to the site at all with nothing but the undetectable network taps we already believe they have.
That said: the linked article is talking about "legally" compelling Google et. al. I don't think that's the only tool in the box. Surely someone at each of these companies has access to the private keys and can be coerced via an appropriate bribe (which at the scales we're talking about could be staggeringly large!) or blackmail attempt to provide it "illegally".
They can't in every case, especially for Google, who use a newer SSL that supports perfect forward secrecy. You are completely correct in the differing magnitudes of attack detectability though.
So historical SSL data captured anywhere between, say 2002 - 2011, could still be decrypted with these keys, right?
I believe that Google has changed them several times even in the last few years though, so it could be that even they don't have access to the old static keys anymore.
https://community.qualys.com/blogs/securitylabs/2013/06/25/s...
Also, as another comment points out, Google uses PFS, so Apple, Yahoo, Microsoft, etc. are better targets for this type of insider attack.
Red herring. We are never discussing active MITM in these NSA threads because they don't do that.
We are discussing offline decryption of monitored SSL traffic, which a CA's key does not help with in any way.
For that attack, you need the server's long-term key and they have to not be using PFS modes.
I believe that this quote in the article pretty much implies an active attack.
For individuals who put encryption on their traffic, we understand that there would need to be some individualized solutions if we get a wiretap order for such persons...C.f. 'tailored access' http://en.wikipedia.org/wiki/Tailored_Access_Operations
I can envision the NSA wanting to undertake active attacks in rare situations, but we don't know whether it has the technical ability to do so under its relationship with AT&T/Verizon/etc. Also even AT&T/VZ/etc. that have historically opened their networks to the NSA for passive surveillance -- in violation of the law -- may have second thoughts if the attacks are active. I suppose you could posit the installation of devices at the target's ISP, but, again, we have no evidence this is something NSA does.
Convince me you know this for a fact.
Attach additional sheets if necessary.
The chief issue in all this is the huge number of trusted CA that are the default in most operating systems. My install of OSX for example has 181 default certificate authorities, and any one of them could be compromised. I'd be willing to bet that a sizeable portion are under nefarious control.
Just to make a point I picked a random CA and tried to look up some information about it. Couldn't reach their site the first time, as they are lacking an A record on their domain root. I've no idea why they would be trusted, as they look sketchy as all hell — http://www.valicert.com/
In the case of an organisation like Google, I don't see why the US government would even need the keys for Googles SSL certificates. Google have all the data they could ever want stored unencrypted anyway (or at least have the ability to decrypt). If they had any legal reason for wanting the content of my gmail account, they could just get the courts to subpoena Google for the data.
I think that's one of the motivations right there. Even if FISA generally gives the government what it wants, it's still a process that the government appears to regard as a hassle to be eliminated.
I think the second reason is that google is a sophisticated enough company that they could perhaps infer things from the data request patterns that the requesting agencies would prefer secret.