0

I have configured a web application with TLS 1.0. My requests are going in the encrypted format through out the channel, which is secured for from the man in the middle attack. TLS is working on RSA mechanism, so the doubt is if the network admin (having the private key) will be able to decrypt the request or not.

Biraja Nalini Rout
  • 23
  • 5
  • 1
    Your question is very unclear. Why would the network admin have the private key? Also, once the traffic gets to the server it's decrypted, so protecting the data at that point is a matter or server-side security, not a TLS issue. – President James K. Polk Jul 25 '17 at 13:43
  • You state "*which is secured for from the man in the middle attack*" but TLS does not protect from MITM attacks. pinning the certificat in the client does. What is a "Network Admin", does that person also have admin access to the server? – zaph Jul 25 '17 at 16:40

1 Answers1

1

First, system or network admin do not have access to the private key if you add an HSM and configure your web server to use it (see https://en.wikipedia.org/wiki/Hardware_security_module).

Secondly, many PFS cipher suites are available with TLS 1.0 (see https://security.stackexchange.com/questions/74270/which-forward-secrecy-cipher-suites-are-supported-for-tls1-0-protocols), so if you only accept such cipher suites on your web server, somebody that can capture your communications and that knows the RSA private key will not be able to decrypt the content of the channel: the cipher key used to protect the channel is ephemeral, it is not your RSA private key.

Alexandre Fenyo
  • 4,526
  • 1
  • 17
  • 24
  • An HSM is certainly a great solution but also rather expensive and not generally available to most who ask such question here. – zaph Jul 27 '17 at 03:06
  • 1
    Personally, I do not agree: the right cost of security investment must be evaluated considering the cost of losing sensitive information and stopping business. This is not because somebody has only a few technical skills about security that he does not need some great and possibly expensive tools. It depends on his business, not on his skills. – Alexandre Fenyo Jul 27 '17 at 06:34
  • I agree and the reality is that many sites are not substantial enough to afford the cost of an HSM. Additionally many of these sites are hosted and the hosting does not provide HSM capabilities or the HSM solution is to expensive, check the AWS [CloudHSM Pricing](https://aws.amazon.com/cloudhsm/pricing/). Of course it would be best if these insecure solution were not deployed but that is a pipe dream as is correct usage of cryptographic primitives. Hopefully these insecure systems will not gain many users. – zaph Jul 27 '17 at 12:38