The security of data traffic over both SSTP & SSL

Question

Suppose you're connected to a VPN server via an SSTP VPN, and then you're trying to sign in to your webmail account that is already secured with an SSL certificate, e.g. hushmail.com.

However, it seems your original data traffic is double-encrypted by both SSTP & SSL. Now suppose that for any reason your SSTP connection is hijacked and decrypted by a third party, e.g. the attacker stole your SSTP password or your SSTP-signed certificate is a fake one.

My question is: does the ability to decrypt the SSTP traffic pose any threat to the security of your email communication? I mean, does this hijacking of SSTP lead to decrypting the SSL traffic of your email?

Answer 1

Assuming that the keys used for the SSL and SSTP layers are independent (which they should be, since both layers have their own separate key setup processes), compromising the outer layer (SSTP) cannot make the inner layer (SSL) any less secure than it would be if used alone.

To see why this is, imagine that there was an attack that did allow breaking SSL + SSTP significantly more easily than plain SSL alone. Then an attacker could break plain SSL just as easily as SSL + SSTP, simply by taking a plain SSL datastream, tunneling it over his own SSTP connection (a trivial operation) and then breaking the combination. But this contradicts the original assumption that breaking SSL alone would be harder than breaking SSL + SSTP.

For a more detailed analysis, see Maurer and Massey, "Cascade Ciphers: The Importance of Being First", Journal of Cryptology 6(1), pp. 55–61, 1993.

Answer 2

I'd like to add to Ilmari's answer. Specifically, Ilmari said:

compromising the outer layer (SSTP) cannot make the inner layer (SSL) any less secure than it would be if used alone.

which is exactly right - however, if the SSTP tunnel has been broken through whatever means the attacker can still pull off any attacks on your key distribution that may be possible - e.g. SSL decrypting proxies. These devices exist (one such example, no affiliation); however, they do require the certificate presented by the proxy to be trusted by the host machine (you). Assuming that is the case, unless you inspect the certificate you won't know you've been compromised.

The next thing I would like to add is that SSTP basically is (at the encryption layer) SSL, specifically SSL 3.0 - therefore any attack on the core encryption process would work for both.

The question of key distribution comes into play again - looking at Windows at least I can see no ability to customize client keys or set an expected server certificate - thus I assume sstp uses the built-in Windows certificate verification procedures. As such, attacks on the PKI chain via SSL decrypting proxies will also work for SSTP.