[TLS] Private Key Security [Was Re: DHE key derivation]

[Michael StJohns <[e-mail]>]

On 9/27/2013 5:00 PM, Yaron Sheffer wrote:
>
> Just a few weeks ago we as a community thought the server's private 
> key was generally secure. Now the entire community seems to assume the 
> private key is easy to steal.

If the server private key isn't inside an HSM (hardware security module) 
of some sort, normal attacks on the server will make it possible to 
steal the key.  Even if encrypted at rest, to be used the key must be 
decrypted and moved to memory at some point.  Anyone who thought 
datafile based server private keys were unconditionally or even 
marginally secure probably hadn't thought it through.

If the server private key IS inside an HSM, the current way session keys 
are derived from the session master key makes it possible for an 
attacker to steal those keys unless the entire TLS negotiation and 
packet processing takes place inside an HSM specifically designed for 
that version of TLS.
> Practically, most private keys will probably not be stolen. 

With respect to whether a key will be stolen or not, you really need 
only compare the value of the data being protected by that key to the 
cost to an attacker to retrieve that key (and the data).  If the value 
of the data is >> or >>> than the cost to attack, chances are someone 
has done so.

HSMs increase the cost of attack and that's a good reason to use them, 
but you still need to consider the relationship of the expected cost to 
attack to the value of the data being protected and adjust your 
protections if the value of the data - to the attacker - exceeds the 
attackers cost of attack.

Mike