-5

I thought that if TLS is well implemented that is sufficient for security.

Today I analyzed PubNub (Global Data Stream Network) and found these steps for security:

  1. communication over TLS
  2. AES-256 to encrypt & decrypt data
  3. and message-signing with HMAC

Isn't it redundant and unnecessary to use the second and third step ? I thought that TLS is an all in one solution.

Please recommend me some books related to this topic.

I want to implement a mission critical service for thousands of people and I want to learn how to do it properly before I begin.

closed as too broad by Mike Ounsworth, user45139, Xander, Steve, Rоry McCune Aug 5 '15 at 11:18

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    Hi and welcome to Security.SE. Please note that this site has a policy against giving book recommendations since they are opinion-based and become out-of-date quickly. You would get less down votes if you edit your question to remove the last two lines. – Mike Ounsworth Aug 4 '15 at 14:33
  • 1
    Perhaps "steps" 2 and 3 are simply guidance for the secure configuration of 1? – gowenfawr Aug 4 '15 at 14:34
  • The steps you post are directly related. TLS can use AES-256 and HMAC (and a few other things) to securely communicate data. As pointed out by others, AES and HMAC can (also) be used to securely store the data. But that's not all -- you'll need to protect who has access to the data, and protect the data as it is being used, and many more issues. If the service you are implementing is as mission critical as you say, I'd recommend adding someone with security qualifications or experience to your team! – Rens van der Heijden Aug 4 '15 at 20:22
5

TLS does one thing. It does it well (if properly implemented), but it does only that. The thing TLS does is protect data in transit. With good implementations and reasonable management of certificates, TLS allows the client to be sure that what it sends and receives really goes to and comes from the intended server; the data was not altered in transit, and no eavesdropper learned anything from it(*).

Once the data is on the other side, TLS is finished and has done its job. But that does not mean that everything is now fine. In particular, data storage is not covered by TLS, and yet it may have security-related issues.

(*) That's not entirely true: eavesdropper can see the length of the exchanged data. The encryption in TLS protects the contents -- the value of the individual bytes -- but not the length.

1

Security methods can never be redundant when used together. It is protection by layers. If no layers were used beyond TLS and the TLS protocol used was to become compromised the whole project would be left wide open. For this reason you should never depend on one solution.

  • He only had one question in his post. "Isn't it redundant and unnecessary to use the second and third step ?" To which I answered to accordingly. – Bacon Brad Aug 5 '15 at 15:22

Not the answer you're looking for? Browse other questions tagged or ask your own question.