How to have both TLS and Time Stamp Signing for data?

Question

As you know, we use TLS for multiple purposes, including integrity, confidentiality and authentication and we use TSAs (Trusted Timestamp Authorities) to have signed timestamps for our data. (Read about it here)

The question is which one of the must be applied first?

In the other words, what is the data which we feed to TSA functions?

1. hash(raw_data)
2. hash(tls_encrypted(raw_data)

For first case the final packet which the final client receives is:

TLS_ENCRYPTED_DATA + TLS_ENCRYPTED_OF_TSA_SIGNATURE 

For the second case, the final packet which the client receives is:

TLS_ENCRYPTED_DATA + TSA_SIGNATURE

Answer 1

You don't provide an actual use case but my guess is that you want to use TLS to transfer data which have a cryptographic time stamp. In this case you need to first time stamp the data and then transfer these. You can also transfer the same time stamped data again and again within multiple TLS connections and the TSA signature stays the same and is still valid.

Time stamping the TLS traffic on the other hand does not really make sense. Since multiple transfers of the same data via TLS would result in different byte streams (since a different key and/or sequence number is used) the time stamp could only be valid for a single transfer.