[Cryptography] hard to trust all those root CAs

[Jerry Leichter]

On Jul 19, 2014, at 5:03 PM, John Denker <jsd at av8n.com> wrote:
> SSL "packet inspection" is an article of commerce.  The fact that
> this is even remotely possible tells me that SSL fails to provide
> the thing I most want it to provide.
>  https://www.google.com/search?q=%22ssl+packet+inspection%22
This is an "it depends" situation.

"Legitimate" (I'll come back to the quotes later) packet inspection is done by companies or other large organizations that provide both the computers (or other devices) and the network connectivity to people they employ.  They act as their own CA, setting up the computers they own to trust a cert that they deploy to the packet inspection device.  This is "legitimate" in the sense that the computers, the network, the CA and the packet inspection device are all owned by the same party, which trusts itself and its own certificate.  SSL is, from the owner's point of view, doing exactly what it's supposed to do.

Of course, from the point of view of those *using* the computers and other equipment, this may not look quite so legitimate.  In theory, those computers and networks are only supposed to be used for business-related activity - so for the owner to look at the messages is perfectly fine.  But we all know that this is a fiction:  Everyone uses employer-provided computers for personal stuff.  And sometimes the lines get very hard to draw anyway - consider someone dealing with their company-provided health insurance provider.  The issue of "legitimacy" here is then not about cryptography, but about legalities and appropriate social policy and expectations.  (Which for me come down on the "not legitimate" side almost all the time, though I see this as an issue that smart phones and 4G Internet connections have the potential to eliminate.)

There *have* been instances where these packet inspection devices have been given certs from "trusted" CA's.  Where these have become public knowledge, they've been universally condemned as "illegitimate" and withdrawn.  How many that *aren't* public knowledge is anyone's guess, of course.  I very strongly doubt the number is 0.
                                                        -- Jerry