After a TLS-enabled server generates a message digest (HMAC), does it sign the digest using the private key of an asymmetric key pair, forming a digital signature?

I'm more interested in knowing whether most of the TLS 1.0/1.1 web servers do it in production environment, rather than whether an RFC allows for it or not.

1 Answer 1


There is no signing involved when using a HMAC. The protection offered by the HMAC comes from the secret used inside the HMAC which is derived from the master secret which itself is the result of the key exchange. See TLS 1.0 RFC sections and 6.3 for the details.

  • Thanks a lot, that is what, unfortunately, I expected. Just read somewhere that this can be done. Jun 16, 2017 at 21:42
  • @AlexeyKalmykov: It might be useful to have a reference to "Just read somewhere" added to your question. Maybe it is an error in the source you mean but maybe also a misinterpretation of it. Jun 16, 2017 at 21:51
  • @StefenUllrich I've just re-read it. Sorry, I was not paying enough attention - they talked about cert, not HMAC. Btw, am I right assuming that signing HMAC by a private key would give it a non-repudiation property? Or is it completly useless activity? Jun 16, 2017 at 22:04
  • @AlexeyKalmykov: it would provide non-repudiation but this information would stay at the TLS protocol level, i.e. not be propagated to the application that exactly this SSL frame was additionally signed. And, TLS already provides non-repudiation because it includes authentication which protects the key exchange and the master key from this protected key exchange is used to derive the secret for the HMAC. Thus the additional signature you propose would not be needed. Jun 17, 2017 at 4:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .