2

Is there any way to prove that a HTML page was delivered to my browser, and not modified in any way, after it was delivered over TLS?

I need to prove integrity, and authenticity of the sender, ideally by the server's public key.

Is there a tool for it?

I can only find information about the handshake methods, but not for the content delivering.

I want to end with a signed HTML page that can be verified with the server's public key

  • 1
    @makerofthings7-C.Lamont I want to have a proof that I bougth something online, for example, and that a site generated an order for me. Already had a problem that a site generated an order and then it disapeared from their servers... – garfanio Apr 8 '15 at 2:51
1

From what I'm understand, what you're trying to do is to verify, after you are sure that the page arrived from the network untouched (since it's TLS), that it has not be modified by any client-side malware.

Since it's a client-side malware, it's safe to presume it can change anything he wants on the client side, after the session is decrypted from the TLS layer. Then, there is no way for you to be sure the data is intact : even if you add a cryptographic signature, the malware could just change your server's public key in memory and resign the HTML, or simply bypass the signature check.

  • Its not always the case for a malware. This has a lot of applications, and would be nice to have a proof that the server generated something to me. – garfanio Apr 8 '15 at 15:45
  • So I'm not supposing a malware, I just need a proof. – garfanio Apr 8 '15 at 15:47
  • Them problem I had once, was due to a server error, and my order got deleted. I could prove they generated the order, if I had the signed HTML. – garfanio Apr 8 '15 at 17:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.