PFS means that even with private keys, you can't read sessions passively. Of course, it can't help with a MITM or taps on unencrypted data.
Server X and User Y are communicating. Some guy Z has X's private key. Z is also passively listening the communication.
- Y sends its public key to X. X sends its public key.
- Y generates a random number (A), encrypts with X's public key sends to X.
- Both X and Z decrypt the number. Now X, Y and Z all know the number A.
- X generates a random number (B), encrypts with Y's public key, sends to Y.
- Since Z does not have Y's private key, it can't decrypt it . At this point, X and Y know A and B, Z only knows A.
- X and Y use a predetermined algorithm using A and B as inputs to generate a new key. Further communications are encrypted/decrypted with this key.
- Z can't decrypt the communication.
It strikes me that once PFS is in place, google would, in theory, be able to keep everything private except those conversations that a court forced them to give up the keys for.
As long as the rule of law were upheld (i.e., warrants/judicial involvement), it seems to me that this model could work and be generalizable for all web traffic. Maybe it's the way forward...
Happy to have my naiveté corrected :)
ECDHE has been in Openssl since version 1.0.0 so its out there just not used.
Btw. Is there any addon for Firefox that shows the “encrypted communication” details like google does?
OK, I guess I was reading too much into the (not very enlightening) definition of PFS on Wikipedia and too little of the actual implementation based on Diffie-Hellman, which has the desired properties.
The question that arises is: how feasible is a MITM attack on this phase of session initiation? Can it be kept undetected?
"Suppose, for example, the NSA was recording all HTTPS encrypted traffic to/from joeswebsite.com in January. Then, in February, they learned the private key for joeswebsite.com. Almost always, that lets them decrypt everything from January, February, March and beyond."
We should instead suppose that the NSA has had the private keys all the time (since it started recording encrypted communication), so every piece of communication that has been recorded can be decrypted even with Perfect Forward Secrecy. I.e. let's assume they got Google's private key immediately when it was last changed, then all communication with Google's servers is decryptable (correct me if I'm wrong).
The NSA doesn't have to brute-force private keys, they just use legal/strong-arm techniques to obtain them, so it doesn't take a lot of computing power and time.