News for hackers. Stuff that matters.

A comment on Room 641A. Parent comment

Re:Room 641A by hpoe on Friday May 29, 2020 @12:36PM (#23352138)
Also I'd be suprise if they don't have a copy or at least acess to all of the maj root certs and websites. Iean sure maybe Facebook or Apple or AWS takes a stand against the govt. Saying "No you can't have our data" but I doubt Verisign or other root level CAs are so scrupulous.
[ Parent | on HN ]
Re:Room 641A by thr0w3345 on Friday May 29, 2020 @05:11PM (#23355601)
But that would only allow them to sign new certs, CA’s don’t get the private keys only the public part to sign... Or did I misunderstand you?
[ Parent | on HN ]
Re:Room 641A by bootloop on Saturday May 30, 2020 @10:48AM (#23361570)
That's correct. To sniff traffic without replacing the certificate with one of their own they would need the the private key which was used in a session. (That key might have been derrived from the server private key, but again nothing the CA has access to.)
[ Parent | on HN ]