1

The question is simple. My private key should only be necessary to resign something if it changes. If I have a static html website, can I use my private key (signed by a CA) to sign all thes html files, send everything except ny private key to the server, and then make nginx deliver them?

I know that in the TLS there is a complex handshake and lots of randomness added to make each session unique but are those dependent on the private key? Is there a TLS method that can do what I want?

If there isn't such a thing, it should exist.

  • No, such a thing does not exist. TLS requires numerous per-session random keys. As null ciphers are not used with TLS, encryption is required alongside signing. Encryption obviously needs to use a unique key for each session. I am currently reading through RFC 5246 (TLS 1.2) and will move this to a more detailed answer soon. Note that signature operations are very fast, so you would not gain much by pre-signing anything. – forest Feb 24 '18 at 4:57
  • @forest it's more about security than saving time. We could have much more secure hosted web apps like myetherwallet.com, and browsers could even have a plugin that only accepts the public key of the developer for that page. It's theoretically possible to create a protocol that does that, though. Should exist in TLS – Guerlando OCs Feb 24 '18 at 5:04
  • @GuerlandoOCs: "Should exist in TLS" - while it might be useful to have such a protocol there is no need to pack any kind of idea somebody has into TLS. Serving pre-signed content is not the use case of TLS but one can create other protocols to do this or extend existing ones like HTTP to include a content signature. – Steffen Ullrich Feb 24 '18 at 6:18
1

TLS is used for protecting the communication between client and server. The application data are encrypted with keys which are unique for each connection and which are created during the key exchange part in the TLS handshake. The key exchange is constructed in a way that both input from client and server is used to create the keys and thus no side has full control over the encryption keys.

The recommended key exchange method is Diffie-Hellman and this is also the only one which is available in TLS 1.3. No private key of the server is even used during the key exchange and thus the private key of the server does not affect how the data gets encrypted. This also means that there is no way to pre-encrypt the data by somehow using the private key. The private key is only used for authentication, i.e. to make sure that the client is actually taking to the correct server.

And while in the older RSA key exchange method the private key of the server is involved to protect the exchanged key it does not influence which key gets created and thus pre-encrypting the contents is not possible in this case too.

In other words: the main point of the private key is to provide authentication to make sure that the client is talking to the correct server. This authentication is done by signing some kind of challenge with this private key and thus proving ownership of this key. Since this challenge is unique for each TLS session the server must actually somehow have access to the private key and cannot just offer pre-signed content.

Still, you could use a certificate in theory to sign all the static content you have and you could then transport this signed content over plain HTTP. This would not protect the content against sniffing but it would protect it against manipulation. While this kind of protection is outside of TLS you can find something like this for instance in mail (S/MIME or PGP). Still, it needs a client which will verify such signatures but there is currently no such client. But there is actually an internet draft which goes in the direction of what you want: Signing HTTP Messages draft-cavage-http-signatures.

  • Just a nitpick, but OP is asking about pre-signing, not pre-encrypting. Still spot on answer though. The gist of it is that the private key is not used to sign the actual data contents, but to verify authenticity. You might want to emphasize that. – forest Feb 24 '18 at 5:10
  • @forest: But the OP is asking about this in the context of TLS and TLS does not provide such thing. But I've edited the answer to point to some protocols which might provide what the OP actually wants, i.e. not having the private key on the server. – Steffen Ullrich Feb 24 '18 at 5:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.