How does the PFS Inbound Inspection work?

[tisc]

Hello Team,

I am wondering how exactly the Inbound Inspection with PFS works?

Diffie-Hellman per definition has the functionality that a key agreement is happening without transfering the key through the "unsecure" channel. All passively listening instances are not able to determine (calculate) the key used for the encryption.

Well with this information ahead and the knowledge that inbound inspection is not using a proxy functionality, there is one question left for me.

How does the firewall gain the key for the encryption with PFS?

Thanks!

[Remo · Accepted solution]

Hi @tisc

Inbound inspection actually also is kind of a proxy, but for client and server a transparent one. Beacause of this fact from a technical view inbound inspection is (like forward inspection) a MitM (Man in the Middle) attack. Between client and server ther is no longer only one decrypted session. Instead there are two: one from the client to the firewall and one from the firewall to the server. This way the firewall is able to inspect the traffic as it is cleartext on the firewall. So back to your question: there is no need for the firewall to gain the encryption keys from somewhere, as the firewall itself generates them.

Hope this helps.

Regards,

Remo