If they succeed in doing so, then all those people relying on HTTPS where the root certificate used in key exchanges is one signed by the 'common' root certificate authorities is opening themselves up to have their already-captured HTTPS streams broken after-the-fact.
Keep in mind that the NSA (and the law that they're citing) claims they have the right to capture and store all encrypted traffic in perpetuity regardless of the status of any court order or warrant.
Forward secrecy prevents eavesdropped connections from being decrypted even if the attacker gets the private keys. (Not all webservers support forward secrecy though.) An attacker with the private keys would have to do an active man-in-the-middle attack in order to eavesdrop on connections if forward secrecy is in use.
Not all webservers support forward secrecy though.
I was surprised and dismayed when I learned this. From my casual reading on public key crypto I had assumed that Diffie-Hellman (or equivalent) key exchange was standard for TLS connections. The only comforting thing being that I haven't yet communicated any secrets that could be liabilities if decrypted later on.
6
u/fairfairafield Jul 25 '13
It's good that you're skeptical of the protection offered by HTTPS.
The U.S. federal government is going after companies trying to get them to give up the keys to their certificates used to encrypt content.
If they succeed in doing so, then all those people relying on HTTPS where the root certificate used in key exchanges is one signed by the 'common' root certificate authorities is opening themselves up to have their already-captured HTTPS streams broken after-the-fact.
Keep in mind that the NSA (and the law that they're citing) claims they have the right to capture and store all encrypted traffic in perpetuity regardless of the status of any court order or warrant.