As you know, we use TLS for multiple purposes, including integrity, confidentiality and authentication and we use TSAs (Trusted Timestamp Authorities) to have signed timestamps for our data. (Read about it here)

The question is which one of the must be applied first?

In the other words, what is the data which we feed to TSA functions?

  1. hash(raw_data)
  2. hash(tls_encrypted(raw_data)

For first case the final packet which the final client receives is:


For the second case, the final packet which the client receives is:


You don't provide an actual use case but my guess is that you want to use TLS to transfer data which have a cryptographic time stamp. In this case you need to first time stamp the data and then transfer these. You can also transfer the same time stamped data again and again within multiple TLS connections and the TSA signature stays the same and is still valid.

Time stamping the TLS traffic on the other hand does not really make sense. Since multiple transfers of the same data via TLS would result in different byte streams (since a different key and/or sequence number is used) the time stamp could only be valid for a single transfer.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.