After a TLS-enabled server generates a message digest (HMAC), does it sign the digest using the private key of an asymmetric key pair, forming a digital signature?

I'm more interested in knowing whether most of the TLS 1.0/1.1 web servers do it in production environment, rather than whether an RFC allows for it or not.


There is no signing involved when using a HMAC. The protection offered by the HMAC comes from the secret used inside the HMAC which is derived from the master secret which itself is the result of the key exchange. See TLS 1.0 RFC sections and 6.3 for the details.

| improve this answer | |
  • Thanks a lot, that is what, unfortunately, I expected. Just read somewhere that this can be done. – Alexey Kalmykov Jun 16 '17 at 21:42
  • @AlexeyKalmykov: It might be useful to have a reference to "Just read somewhere" added to your question. Maybe it is an error in the source you mean but maybe also a misinterpretation of it. – Steffen Ullrich Jun 16 '17 at 21:51
  • @StefenUllrich I've just re-read it. Sorry, I was not paying enough attention - they talked about cert, not HMAC. Btw, am I right assuming that signing HMAC by a private key would give it a non-repudiation property? Or is it completly useless activity? – Alexey Kalmykov Jun 16 '17 at 22:04
  • @AlexeyKalmykov: it would provide non-repudiation but this information would stay at the TLS protocol level, i.e. not be propagated to the application that exactly this SSL frame was additionally signed. And, TLS already provides non-repudiation because it includes authentication which protects the key exchange and the master key from this protected key exchange is used to derive the secret for the HMAC. Thus the additional signature you propose would not be needed. – Steffen Ullrich Jun 17 '17 at 4:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.