SSL加密对棱镜计划截取到的数据是否起到保护隐私作用?
无效的理由是，政府为什么不能跑到赛门铁克的下属公司verisign把证书要了来？救济的理由，有小部分的TLS的密钥交换算法使用了“正向安全”的ECDHE-RSA套件(似乎是指使用了椭圆曲线算法的DH密钥交换算法)Google有如下说明，没有正向安全时，只要有服务器端的TLS证书私钥部分就能解密整个加密流(因为计算密钥最重要的自变量premaster secret是用公钥加密送给服务器的，别的自变量都是公开的，只要有私钥就能解开加密的premaster secret)。但是这个方法似乎对正向安全版本不适用。Most major sites supporting HTTPS operate in a non-forward secret fashion, which runs the risk of retrospective decryption. In other words, an encrypted, unreadable email could be recorded while being delivered to your computer today. In ten years time, when computers are much faster, an adversary could break the server private key and retrospectively decrypt today’s email traffic.Forward secrecy requires that the private keys for a connection are not kept in persistent storage. An adversary that breaks a single key will no longer be able to decrypt months’ worth of connections; in fact, not even the server operator will be able to retroactively decrypt HTTPS sessions.Forward secret HTTPS is now live for Gmail and many other Google HTTPS services(*), like SSL Search, Docs and Google+. We have also released the work that we did on the open source OpenSSL library that made this possible. You can check whether you have forward secret connections in Chrome by clicking on the green padlock in the address bar of HTTPS sites. Google’s forward secret connections will have a key exchange mechanism of ECDHE_RSA.http://googleonlinesecurity.blogspot.com/2011/11/protecting-data-for-long-term-with.html参考内容：HTTPS连接最初的若干毫秒RSA算法原理（一）
■网友
如果是在传输过程中截取，那么应当是有效的，目前应该没什么可行的大规模窃听SSL加密连接的方法。但是如果是直接向数据存储的公司获取，那么任何基于传输的加密方式都是无效的，就如同TG直接向新浪要数据之类的。棱镜计划看起来应该是两个部分的结合，总体而言，尽量使用SSL加密还是很好的习惯，不仅仅是棱镜。毕竟直接获取数据的量应该不会很大。
推荐阅读
- SSL数字证书哪家的最好?
- aes对称加密，需要加签名验证防止篡改吗如果需要该咋签名才是最好的方案
- 怎样把wifi密码加密，不让别人破解
- 中国有没有类似棱镜这样计划
- 怎样防止网站上传木马
- 在云盘存色情文件犯法不犯
- cygwin下源码编译openssl出错
- 美国限制128bit的SSL出境 怎样做到的这种限制呢
- 请问一下比较常见的做法HTTPS是基于TLS还是SSL
- 小米加密兔是啥