| Transparent SSL emulation | | Print | |
|
Israeli startup BreachView has a plugin for Linux that emulates a virtual NIC and provides "transparent SSL emulation". They claim to be selling like hotcakes, I met the CTO at a show a couple weeks ago, and decided to take a closer look - I later discovered that they only support RSA key exchange - a serious limitation.
In a white paper on the BreachView Web site, on page 8 they state, "The BreachView SSL decryption engine securly maintains the key information of the web sites to be inspected and performs the decryption process when SSL traffic is received." On page 11 they state they only support the RSA method for key exchange. BreachView only supports a SSL protocol that is using the RSA method to exchange the session key and can not monitor transactions that use the Diffie-Helman key exchange. In the RSA method, the client generates a random number and encrypts it with the server' public-key. Since BreachView has a copy of the server' private key, it is able to decrypt the session key on-the-fly. Note, that vast majority of SSL communications today uses Diffie-Helman key exchange. It was designed specifically to prevent "man in the middle attack" that Breachview is trying to capitalize on. I understand that there is high demand for "SSL decryption silver bullet"-type of solution, but there is no simple technological tool available.At least not today, so I guess we'll have to stay tuned.
|