In some ways what you propose sounds even scarier, i.e. figure out the best way to look inside SSL encrypted data without having the key.
But in terms of privacy and trust, CloudFlare is already in the position of terminating SSL connections and establishing new ones to origin web servers. We take the protection of that data and the associated keys very seriously. There will be more announcements over the coming weeks and months about how we secure things.
I'm not quite following how having just enough insights about the encrypted data to perform DDOS mitigation would be scarier than having full read- and write access to the cleartext. Thanks for the responses though, and definitely looking forward to those blogs.
You are implying something fundamental: that the encrypted traffic could be adequately analysed for insight without the need for decryption.
Yet to do so would be to defeat SSL itself, or at least to declare it as insufficient to adequately protect secrets.
What CloudFlare is doing isn't defeating SSL or any kind of attack on it. They are merely working around some prior limitations on requiring access to an organisation's private key.
As a proxy that is charged with DDoS protection (and other types of protection and performance improvements), they are being asked to terminate and work on the unencrypted data to a very strict set of complience by the end organisations, but they need to do this in a way that does not involve possessing or having access to the private key.
Their solution works extremely well given the multiple constraints (technological and legal) that they have.
> You are implying something fundamental: that the encrypted traffic could be adequately analysed for insight without the need for decryption.
> Yet to do so would be to defeat SSL itself, or at least to declare it as insufficient to adequately protect secrets.
This is possible through HTTPS traffic analysis, see [0] and [1] for starters. Of course, it's much easier for Cloudflare to do analysis for DDoS protection if they have access to plaintext.
Whether this means that SSL is, as you say, "insufficient to adequately protect secrets" is an interesting discussion to have.
But in terms of privacy and trust, CloudFlare is already in the position of terminating SSL connections and establishing new ones to origin web servers. We take the protection of that data and the associated keys very seriously. There will be more announcements over the coming weeks and months about how we secure things.