Download The key questions that we`d like to ask at the beginning

Security for an Imperfect World
Perfect Forward Secrecy Provides Better Protection for Your Website
You don’t want your email to be read by other people. You don’t want your credit card
information swiped by some hacker online.
And that’s why there are secure Web pages—those pages that are transmitted via HTTPS rather
than HTTP. HTTPS (the S stands for secure) uses a public key and a private key to encrypt
communications between a browser and the server that it’s talking to so no one else can listen
in.
Or so everyone thought.
Then came the Heartbleed bug, which revealed that HTTPS sessions are indeed vulnerable to
attack if a hacker can learn a server’s private key, which can be used to unscramble encrypted
information and read anything that’s sent to the server.
In other words, one simple key can unlock a goldmine of data. And with some of the biggest
websites and networking devices in the world susceptible to Heartbleed—some estimates say
it’s two out of three Internet servers—millions of passwords, credit card numbers, and other
personal information have been put at risk.
This is where perfect forward secrecy (PFS) comes in. PFS provides a better way of preventing
snoops and criminals from gaining access to a server’s private keys. It provides an added layer
of security not available with common OpenSSL products. It protects you even if an
eavesdropper does gain access.
It’s important to note that the SSL certificates themselves are not vulnerable. Symantec offers a
free tool you can use to check your security and make sure your certificate is installed correctly
and employs the latest protection. To check your certificate, go to
https://ssltools.websecurity.symantec.com/checker/views/certCheck.jsp.
Reliable security
PFS is an alternative to the most popular form of encryption on the Internet. It uses the DiffieHellman algorithm to generate short-term keys. This algorithm is not for encryption or
decryption. It enables two parties involved in communication to generate a shared, short-term
secret key for exchanging information confidentially on a per-session basis.
When PFS is in place, the compromise of a server’s private key does not necessarily expose
sensitive data. That’s because sites that use PFS generate an ephemeral per-session key that’s
not revealed even if the long-term private key is compromised. The security of PFS depends on
both parties discarding the shared per-session key after their transaction is finished.
www.eccolomedia.com
In simple terms, PFS provides an added layer of security even if an eavesdropper listens in on
your entire conversation. Because if a hacker does manage to gain access to the private key, he
still won’t be able to recover the shared, short-term secret key and will not be able to decrypt
any communications. What’s more, PFS continuously changes the key material during a session,
generating a new key for each message in a conversation.
Still not ubiquitous
So if PFS is better, why doesn’t every website use it? For starters, it can be costly. The system of
cryptography used in PFS is slightly more complex than traditional techniques, so it requires
more processing power. And the Diffie-Hellman algorithm works more slowly, so many
websites have disabled the feature to improve site performance.
But as the Heartbleed bug shows, the cost of not running PFS can be far greater than a slight
drop in website speed. Even before Heartbleed, forward-thinking websites announced their
intention to enable PFS. Twitter introduced PFS to protect information from spies and
cybercriminals. Google, too, has embraced PFS.
Unfortunately, most HTTPS websites still don’t support PFS, which means that a large chunk of
your past communications with those servers is vulnerable to decryption if private keys are
compromised at some later date. As of January 2014, only 5 percent of transport-layer-securityenabled websites were configured to use cipher suites that provide PFS to Web browsers,
according to SSL Pulse, a project that monitors the quality of SSL support across 1 million
websites.
But implementing PFS doesn’t have to be a risk versus performance scenario. In fact, it’s
possible for websites to enable PFS without sacrificing speed or performance.
The Diffie-Hellman protocol has a significant processor overhead compared to traditional forms
of key generation. However, the Elliptic Curve Diffie-Hellman—another algorithm based on
Diffie-Hellman that also supports PFS—has minimal CPU overhead compared to traditional
techniques. That’s because elliptic curve cryptography (ECC) uses elliptic curve planes to
increase the performance of the algorithm, making PFS much quicker.
Safe today, safe tomorrow
In the aftermath of the Heartbleed vulnerability, PFS is more important than ever. “Whether
that threat is an existing or future software bug, an insider who steals the key, a secret
government demand to enable surveillance, or a new cryptographic breakthrough, the beauty
of forward secrecy is that the privacy of today’s sessions doesn’t depend on keeping
information secret tomorrow,” writes Yan Zhu of Electronic Frontier Foundation, a nonprofit
organization that works to defend civil liberties in the digital world.
www.eccolomedia.com
That’s not the case with traditional systems of key generation. If a private key is stolen
tomorrow, any information stored on a server becomes vulnerable, even if it’s several years
old.
Due to its long history with ECC, Symantec is the perfect choice for websites that want to
implement PFS without sacrificing speed or performance. Indeed, ECC boasts better
performance than traditional types of key generation. Here are some other benefits:
•
•
ECC performance numbers are expected to significantly improve over time as the
industry optimizes for it.
With better performance, customers will need to purchase fewer servers to handle SSL
connections, resulting in significant cost savings.
An ECC certificate is included at no additional cost with all Symantec™ Secure Site Pro SSL
certificates. Symantec’s ECC certificate roots have been in place for more than five years. You
can be confident that your ECC certificate will work throughout your ecosystem.
Trust Symantec to keep your website safe now and into the future—a perfect solution for an
imperfect world.
To learn more, call your Symantec account representative. Or visit Symantec.com.
Copyright © 2014 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo, and the
Checkmark Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the
U.S. and other countries. Other names may be trademarks of their respective owners.
www.eccolomedia.com