Prove forward secrecy by looking at what a key recovers

short · 50 min · Objective 3.3

Task

Capture two sessions -- one negotiated with forward secrecy and one without -- and demonstrate that possession of the server key decrypts only one of them.

Steps

  1. Stand up the server with a certificate and key you hold, and configure it to permit a non-forward-secret key exchange.
  2. Capture a session negotiated WITHOUT forward secrecy, then decrypt the capture using the server private key, and record the result in lab/fs-without.txt.
  3. Restrict the server to forward-secret suites only, capture another session, attempt the same decryption with the same key, and record the failure in lab/fs-with.txt.
  4. Record the negotiated cipher suite for each session in lab/fs-suites.txt.
  5. Write lab/fs-note.md on what this means for an organisation that decrypts traffic for inspection by giving a device the server key, and where inspection has to move instead.

Verify

grep -Eic 'decrypt|plaintext|http' lab/fs-without.txt
grep -Eic 'cannot|unable|no session key|fail' lab/fs-with.txt
grep -Eic 'ecdhe|dhe' lab/fs-suites.txt
grep -Eci 'endpoint|terminating proxy|inspection' lab/fs-note.md

A successful decryption WITHOUT forward secrecy and a failed one WITH it, the suites recorded, and the note naming where inspection has to move. The pair is the evidence; either alone proves nothing.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.