Papers › Passive, Transparent, and Selective TLS Decryption for Network Security Monitoring
Passive, Transparent, and Selective TLS Decryption for Network Security Monitoring
Florian Wilkens, Steffen Haas, Johanna Amann, Mathias Fischer
The archive published only this paper's code-link row. Authors, date and abstract are from arXiv's metadata (CC0), read from the Kaggle arXiv metadata snapshot of 2026-09-12 where its title matched the archive's; the title is the archive's.
Internet traffic is increasingly encrypted. While this protects the confidentiality and integrity of communication, it prevents network monitoring systems (NMS) and intrusion detection systems (IDSs) from effectively analyzing the now encrypted payloads. Therefore, many enterprise networks have deployed man-in-the-middle (MitM) proxies that intercept TLS connections at the network border to examine packet payloads and thus retain some visibility. However, recent studies have shown that TLS interception often reduces connection security and potentially introduces additional attack vectors to the network. In this paper, we present a cooperative approach in which end-hosts as cryptographic endpoints selectively provide TLS key material to NMS for decryption. This enables endpoints to control who can decrypt which content and lets users retain privacy for chosen connections. We implement a prototype based on the Zeek NMS that is able to receive key material from hosts, decrypt TLS connections and perform analyzes on the cleartext. The patch is freely available and we plan to upstream our changes to Zeek once they are mature enough. In our evaluation, we discuss how our approach conceptually requires significantly less computational resources compared to the commonly deployed MitM proxies. Our experimental results indicate, that TLS decryption increases a runtime overhead of about 2.5 times of the original runtime on cleartext. Additionally, we show that the latency for transmitting keys between hosts and the NMS can be effectively addressed by buffering traffic at the NMS for at least 40ms, allowing successful decryption of 99.99% of all observed TLS connections.
Code
Repository list and official/mentioned flags are the archive's, frozen 2025-07-28. Reachability, where shown, is from one Syntology probe window (2026-09-16 to 2026-09-18); repositories not probed show nothing. GitHub stars are not tracked.
Code Syntology ran Syntology
Not run by Syntology. Nothing on this page verifies that the listed code works.
Results from the paper archive 2025-07-28
No leaderboard rows for this paper in the archive.
Report a problem or propose a change · a person checks every report against the paper or source before anything changes; decisions are listed on /corrections