Announcing Keyless SSL

#1

Post by jgrahamc » Thu, Sep 18, 2014, 1:02 PM UTC

Announcing Keyless SSL
blog.cloudflare.com

Re: Announcing Keyless SSL

#2

Post by teddyh » Thu, Sep 18, 2014, 1:21 PM UTC

So the communication between Cloudflare and the actual SSL key holder is secured by… what? Another key? In that case, any compromise of Cloudflare’s key is the same as a compromise of the original SSL key (at least in the short term).

Re: Announcing Keyless SSL

#3

Post by kcbanner » Thu, Sep 18, 2014, 1:21 PM UTC

Interesting, but what about the latency issues of having to always contact the key server?

Re: Announcing Keyless SSL

#4

Post by personZ » Thu, Sep 18, 2014, 1:22 PM UTC

After reading the beginning of the piece, I was expected something more...profound. Some deep mathematical breakthrough or something.

Instead they separate the actual key signing, delegating it to the customer's device. That's nice and useful, but isn't quite what I was expecting.

Re: Announcing Keyless SSL

#5

Post by spacefight » Thu, Sep 18, 2014, 1:23 PM UTC

teddyh wrote: post #2

So the communication between Cloudflare and the actual SSL key holder is secured by… what? Another key? In that case, any compromise of Cloudflare’s key is the same as a compromise of the original SSL key (at least in the short term).

Same thought here. And what if that connection breaks? Another single point of failure?

Re: Announcing Keyless SSL

#6

Post by spacefight » Thu, Sep 18, 2014, 1:24 PM UTC

personZ wrote: post #4

After reading the beginning of the piece, I was expected something more...profound. Some deep mathematical breakthrough or something. Instead they separate the actual key signing, delegating it to the customer's device. That's nice and useful, but isn't quite what I was expecting.

Yes - and it's nowhere near "keyless" - it's just that the key is somewhere elseTM.

Re: Announcing Keyless SSL

#7

Post by blibble » Thu, Sep 18, 2014, 1:24 PM UTC

isn't this completely missing the point, i.e. banks being able to say 'no third parties can see our clients identifying information/balances/etc?'

yes, the SSL key doesn't leave the bank, but everything it is protecting is..

Re: Announcing Keyless SSL

#8

Post by jgrahamc » Thu, Sep 18, 2014, 1:25 PM UTC

kcbanner wrote: post #3

Interesting, but what about the latency issues of having to always contact the key server?

There's a very technical blog post coming on this tomorrow, but that problem is addressed by session tickets and by the fact that most of the TLS handshake is occurring with a CloudFlare server typically nearer the web browser than before.

Re: Announcing Keyless SSL

#9

Post by jgrahamc » Thu, Sep 18, 2014, 1:26 PM UTC

spacefight wrote: post #5

teddyh wrote: post #2

So the communication between Cloudflare and the actual SSL key holder is secured by… what? Another key? In that case, any compromise of Cloudflare’s key is the same as a compromise of the original SSL key (at least in the short term).

Same thought here. And what if that connection breaks? Another single point of failure?

Multiple connections between CloudFlare and the Keyless SSL Server running at the customer site. Connections are reused, pipelined, load balanced etc.

Re: Announcing Keyless SSL

#10

Post by [deleted] » Thu, Sep 18, 2014, 1:28 PM UTC

teddyh wrote: post #2

So the communication between Cloudflare and the actual SSL key holder is secured by… what? Another key? In that case, any compromise of Cloudflare’s key is the same as a compromise of the original SSL key (at least in the short term).

[deleted]