When using the perfect forward secrecy (PFS) key exchange, how does a firewall behave when SSL Inbound Inspection is enabled?

The correct answer is A. It acts as meddler-in-the-middle between the client and the internal server. Perfect Forward Secrecy (PFS) uses ephemeral key exchange algorithms (such as ECDHE or DHE), meaning each session uses a unique temporary key pair. Because the session key is never derived from the server's long-term private key, the firewall cannot passively decrypt PFS…

SSL/TLS Decryption and Inspection

Question

Options

AIt acts as meddler-in-the-middle between the client and the internal server.
BIt acts transparently between the client and the internal server.
CIt decrypts inbound and outbound SSH connections.
DIt decrypts traffic between the client and the external server.

How the community answered

(53 responses)

A
94% (50)
B
2% (1)
C
4% (2)

Explanation

Perfect Forward Secrecy (PFS) uses ephemeral key exchange algorithms (such as ECDHE or DHE), meaning each session uses a unique temporary key pair. Because the session key is never derived from the server's long-term private key, the firewall cannot passively decrypt PFS traffic by simply using a copy of the server's private key (which is how passive/transparent SSL Inbound Inspection normally works). Instead, when PFS is in use, the firewall must act as a meddler-in-the-middle (MITM): it terminates the TLS session from the client, decrypts the traffic, re-encrypts it, and establishes a separate TLS session to the internal server. This active interception is required to inspect PFS-protected traffic.

Topics

#SSL Inspection#PFS#Firewall Security#Meddler-in-the-Middle

Community Discussion

No community discussion yet for this question.

Full NETSEC-GENERALIST Practice