Re: [arch-d] Off topic [was: IAB Statement on Encryption and Mandatory Client-side Scanning of Content]

On 20-Dec-23 13:54, Phillip Hallam-Baker wrote:
> If that is the way it works, it does not.

If the user doesn't have to configure it with their private keys, the only way it can work is by inserting itself in code paths inside the TLS implementation.

> The only cases where anything like that has happened have been nation state actors getting deep into the supply chain. Cases like Crypto AG.

If what they are doing is using a virus-like technique to hot patch compiled open source code, I don't think you can say they're *in* the supply chain.

After a brief search, the relevant patent appears to be US11805107. It uses the word "instrument" in a context where most of us would use "infect", e.g. when discussing "instrumenting" /usr/lib/libssl.so.1.1 to extract keys.

Certainly, this subverts the purpose of TLS, by subverting the host implementation. So, not a protocol issue. However, it means that users cannot know whether their encrypted session is being read by their friendly web service provider, possibly under government orders.

For example, it appears that any AWS service you use might be affected:
https://aws-quickstart.github.io/quickstart-nubeva-tlsdecrypt/

    Brian

> 
> 
> 
> 
> On Tue, Dec 19, 2023 at 6:13 PM Hesham ElBakoury <helbakoury@gmail.com <mailto:helbakoury@gmail.com>> wrote:
> 
>     Brian,
>     The way it works is described here:
>     https://www.nubeva.com/pillar/get-session-keys <https://www.nubeva.com/pillar/get-session-keys>
> 
>     Nubeva is in AWS market place. It is used with AWS VPC:
>     https://aws.amazon.com/marketplace/pp/prodview-aex37bzqx6hxi <https://aws.amazon.com/marketplace/pp/prodview-aex37bzqx6hxi>
> 
>     Hesham
> 
>     On Tue, Dec 19, 2023, 2:00 PM Brian E Carpenter <brian.e.carpenter@gmail.com <mailto:brian.e.carpenter@gmail.com>> wrote:
> 
>         Hesham,
>         On 19-Dec-23 11:59, Hesham ElBakoury wrote:
> 
>          > Nubeva has developed technology to extract TLS keys to be used by 3rd party tools to decrypt and inspect the traffic [https://www.nubeva.com/hubfs/Downloadables/Nubeva%20SSL%20Solution%20Brief_Nov%202019.pdf <https://www.nubeva.com/hubfs/Downloadables/Nubeva%20SSL%20Solution%20Brief_Nov%202019.pdf>].
>          >
>          > Would this violates client privacy?
>          >
> 
>         I may be missing something, but I don't understand how this product could work unless the "Sensor" component is configured with the server's private keys. Is that correct?
> 
>              Brian
> 
>     _______________________________________________
>     Architecture-discuss mailing list
>     Architecture-discuss@ietf.org <mailto:Architecture-discuss@ietf.org>
>     https://www.ietf.org/mailman/listinfo/architecture-discuss <https://www.ietf.org/mailman/listinfo/architecture-discuss>
> 