Decryption of perfect forward secrecy (pfs) and non-pfs sessions

A network monitor for observing network traffic and selecting active or passive decryption mode between a downstream client and an upstream server, the network monitor comprising:

• a memory configured to store a plurality of programmable instructions;
• and
• at least one processing device in communication with the memory, wherein the at least one processing device, upon execution of the plurality of programmable instructions is configured to:
• select a decryption mode in an initial stage of setting up a secure session based on a determination of a most probable decryption mode based on decryption modes used for similar and/or past secure sessions, wherein the initial stage is when the client initiates a transport layer connection before the transport layer connection or the secure session is established;
• validate the selected decryption mode at least once during the secure session based on whether the selected decryption mode is actually and/or is probably supported based on security algorithms supported by the client and/or server;
• and
• switch the decryption mode based on a result of validating the selected decryption mode.

A non-transitory computer readable storage medium and one or more computer programs stored therein, the computer programs comprising instructions, which when executed by a computer system, cause the computer system to:

• select a decryption mode in an initial stage of setting up a secure session based on a determination of a most probable decryption mode based on decryption modes used for similar and/or past secure sessions, wherein the initial stage is when the client initiates a transport layer connection before the transport layer connection or the secure session is established;
• validate the selected decryption mode at least once during the secure session based on whether the selected decryption mode is actually and/or is probably supported based on security algorithms supported by the client and/or server;
• and
• switch the decryption mode based on a result of validating the selected decryption mode.