Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keyless SSL: The Nitty Gritty Technical Details

blog.cloudflare.com

Post reply on HN
Print view View original

11–20 of 69 posts

Re: Keyless SSL: The Nitty Gritty Technical Details

#11

Post by jgrahamc »

vader1 wrote: post #8
jgrahamc wrote: post #5

Earlier quoted context omitted.

Because DDoS protection isn't just something you do at the network layer. It's important to be able to apply filtering at the "application" level.

I understand that there are many different types of DDOS attacks, and that for some of them having access to the content on the application level makes your job of mitigating them a lot easier. But even without that, would comparing the encrypted traffic patterns for an individual client to other client's patterns (or to that client's traffic to one of the other 2 million Cloudflare websites); and analyzing the encry…

In some ways what you propose sounds even scarier, i.e. figure out the best way to look inside SSL encrypted data without having the key.

But in terms of privacy and trust, CloudFlare is already in the position of terminating SSL connections and establishing new ones to origin web servers. We take the protection of that data and the associated keys very seriously. There will be more announcements over the coming weeks and months about how we secure things.

Re: Keyless SSL: The Nitty Gritty Technical Details

#12

Post by xorcist »

Interesting read. Still no information how it compares to other HSM implementations however, and why they didn't use the more well studied PKCS protocols in theirs.

I would imagine the problem was more with existing implementations rather than some problems with HSMs per se, as they probably have much larger latency than you normally have so things like blocking reads start to matter.

Re: Keyless SSL: The Nitty Gritty Technical Details

#15

Post by vader1 »

jgrahamc wrote: post #11
vader1 wrote: post #8

Earlier quoted context omitted.

I understand that there are many different types of DDOS attacks, and that for some of them having access to the content on the application level makes your job of mitigating them a lot easier. But even without that, would comparing the encrypted traffic patterns for an individual client to other client's patterns (or to that client's traffic to one of the other 2 million Cloudflare websites); and analyzing the encry…

In some ways what you propose sounds even scarier, i.e. figure out the best way to look inside SSL encrypted data without having the key. But in terms of privacy and trust, CloudFlare is already in the position of terminating SSL connections and establishing new ones to origin web servers. We take the protection of that data and the associated keys very seriously. There will be more announcements over the coming week…

I'm not quite following how having just enough insights about the encrypted data to perform DDOS mitigation would be scarier than having full read- and write access to the cleartext. Thanks for the responses though, and definitely looking forward to those blogs.

Re: Keyless SSL: The Nitty Gritty Technical Details

#16

Post by kordless »

xorcist wrote: post #9
vader1 wrote: post #4

Interesting how they specifically refer to yesterday's discussion here on HN and over at Reddit, but don't go into the frequently mentioned complaint that despite not having access to the PK itself, Cloudflare can still intercept and modify all cleartext sent between the client and server, which for most intents and purposes means pretty much the same. Maybe not intentionally so, but it comes off as slightly misleadi…

They can manipulate traffic, but so can the bank's operations division. The fact that Cloudflare is a different organization makes contractual agreements much more important, but as long as they are in proper order the difference shouldn't be of importance to the end user.

It's still based on implicit human trust though.

Re: Keyless SSL: The Nitty Gritty Technical Details

#18

Post by vader1 »

xorcist wrote: post #9
vader1 wrote: post #4

Interesting how they specifically refer to yesterday's discussion here on HN and over at Reddit, but don't go into the frequently mentioned complaint that despite not having access to the PK itself, Cloudflare can still intercept and modify all cleartext sent between the client and server, which for most intents and purposes means pretty much the same. Maybe not intentionally so, but it comes off as slightly misleadi…

They can manipulate traffic, but so can the bank's operations division. The fact that Cloudflare is a different organization makes contractual agreements much more important, but as long as they are in proper order the difference shouldn't be of importance to the end user.

The difference to the end user is that while the bank's operations division can only do this for a single website, Cloudflare can do so for 2 million of them.

Re: Keyless SSL: The Nitty Gritty Technical Details

#19

Post by ZoFreX »

kordless wrote: post #16
xorcist wrote: post #9

Earlier quoted context omitted.

They can manipulate traffic, but so can the bank's operations division. The fact that Cloudflare is a different organization makes contractual agreements much more important, but as long as they are in proper order the difference shouldn't be of importance to the end user.

It's still based on implicit human trust though.

Well for that matter so is the assurance that only you can purchase a valid SSL certificate for a domain you own. At some point, you gotta trust some people!

Re: Keyless SSL: The Nitty Gritty Technical Details

#20

Post by alexwilliamsca »

corobo wrote: post #17
alexwilliamsca wrote: post #13

The Keyless SSL server is open source and available on GitHub - https://github.com/cloudflare/keyless - although I'm wondering if its dependence on OpenSSL was a good choice.

Out of curiosity what would you have used?

CyaSSL - http://www.yassl.com/yaSSL/Products-cyassl.html
Post reply on HN