RE: IDS, IPS and encrypted traffic

["Eric McCarty" <eric () piteduncan com>]

I don't want to re-state the obvious but if the traffic is sent from
Host A to Host B, and Host B has the appropriate Key to decrypt the
traffic, this decryption will/should (generalization of course) occur at
a lower level of the TCP/IP stack long before the application see's it.
Thus what the IDS/IPS See's (assuming HIDS/HIPS as u stated) will be
decrypted data. 

However if you have traffic that is intended from Host A to Host B and
you are trying to analyze it using Host C, you would need to provide the
Key to Host C to be able to Decrypt the traffic to analyze it. I don't
believe any vendor will say "We can analyze the encrypted payload of any
TCP or IP Packet across the wire", they may be able to analyze the
header, but not the payload. 

That's kinda the whole point of encryption. 


Eric McCarty

-----Original Message-----
From: Daniel Hamburg [mailto:daniel.hamburg () iis rub de] 
Sent: Wednesday, December 01, 2004 11:15 PM
To: Focus IDS List
Subject: IDS, IPS and encrypted traffic

Hello everybody,

I've been looking around the net for a while, trying to find some
theoretical and practical approaches to solve the problem of analyzing
encrypted traffic.

I know, that there is a need to decrypt the traffic before analyzing it,
but I haven't found any concrete solutions neither for NIDS nor for HIDS
yet. Some HIDS vendors announced that their products are capable of
analyzing encrypted traffic, but I didn't succeed to find any details
about that.

Does anybody know some products or papers which deal with the problem of
analyzing encrypted traffic?

Thanks in advance,
  Daniel Hamburg


------------------------------------------------------------------------
--
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------
--


--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------