2
$\begingroup$

I'm writing an article about new government law in Kazakhstan. The law was accepted in December, but now one of our providers announced information for small and medium business how to install government-provided root SSL certificate: https://www.beeline.kz/b2b/sme/ru/press_centers/10040

Yes, they really want to listen the whole traffic of all citizens.

I want to show in my article that this is really-really bad solution. And I need all information about possible vulnerabilities of it.

The certificate is valid for 4 years, data size, as I think, 1024 bytes.

Link to the cert: https://www.beeline.kz/uploads/document/file/11120/QAZNET.rar

$\endgroup$

closed as off-topic by otus, e-sushi Mar 10 '16 at 19:43

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Requests for analyzing or deciphering a block of data are off-topic here, as the results are rarely useful to anyone else." – e-sushi
If this question can be reworded to fit the rules in the help center, please edit the question.

3
$\begingroup$

First - please REALLY check the certificate, download it, open and have a look into details (4096 bit, 30y validity). I don't think your government wants to be insecure themselves (so other parties will act on behalf of it).

If the certificate is to be used as a root (or issuing) certificate for other nationally issued certificates, you need it to be trusted (otherwise all national sites won't be recognized as trusted). It cannot be used to decrypt your traffic (as man in the middle) itself.

The only question to be answered, how trustworthy is the "Qaznet" issuer. Nothing prevents them (except the law and they would loose all credibility) to issue e.g. a google server certificate which will be trusted to all having the root / intermediate certificate as trusted (see http://arstechnica.com/security/2013/01/turkish-government-agency-spoofed-google-certificate-accidentally/ ). It is all about the trust. If you trust the CA provider or not (Qaznet).

$\endgroup$
  • $\begingroup$ About the trust: groups.google.com/forum/#!searchin/mozilla.dev.security.policy/… $\endgroup$ – Thunderbird Mar 10 '16 at 15:45
  • $\begingroup$ Some updates on July 2019. Kazakhstan government is now enforcing all people in the country to install this root Qaznet certificate to "avoid disruptions of Internet access". Basically, we have one more country building a Great Firewall with all traffic being decrypted and monitored. $\endgroup$ – Yeldar Kurmangaliyev yesterday
  • $\begingroup$ @YeldarKurmangaliyev indeed, the situation is described as well in the bugzilla. Indeed this is misusing the CA authority. I believe the Google Chrome at least enforces using correct certificates for Google services, but for the rest .. seems the providers will allow decrypting the traffic :( If all providers will comply with the regulations, you cannot do much about it, maybe using foreign VPN or Thor (which can be blocked, but not decrypted). $\endgroup$ – gusto2 19 hours ago

Not the answer you're looking for? Browse other questions tagged or ask your own question.