Suppose I download a file hxxps://example.com/somefile.txt with a client that logs everything, including short-term session keys.

Do these logs constitute sufficient proof that the given file has indeed been served by someone having a private key for example.com?


No, such logs would not prove (to a third party) that the given file was served by someone holding the private key.

TLS works in two phases:

  1. The server makes use of its private key to prove its identity to the client and negotiate a session key.
  2. The session key is used to encrypt and authenticate the application data.

The client and server both have access to the session key. The server's private key is not involved in the second phase at all.

So, having negotiated a genuine session key with the server and captured a genuine handshake to prove it, a malicious client could then proceed to use this session key to falsify the rest of the log and claim that the server sent it a different response.

  • Hi @John, is there a reason for the server and the client to not sign the record (or a HMAC of the record) at the end of the protocol? Same way as chess players sign the sheet at the end of the game. It would provide this proof and at the same time it would serve as an insurance for the server against misbehaving clients. May 11 '19 at 15:20
  • I don't know. If I had to guess, I'd say there just wasn't a reason to sign it, and doing so would negatively impact performance. May 11 '19 at 18:14
  • I see. I'm thinking about the goal of proving content provenance, see this question: security.stackexchange.com/questions/210003/… May 11 '19 at 18:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.