Linked Questions

4 votes
1 answer
236 views

Can you prove to a 3rd party, that a HTTPS TLS session took place? [duplicate]

Alice is a (potentially modified) browser/client. Bob is a non-modified HTTPS web server running common security practices. Eve is collecting data from Bob from many Alices, Eve needs this ...
Ryan Leach's user avatar
1 vote
1 answer
168 views

Can a TLS HMAC be used after the fact to verify the authenticity of a message? [duplicate]

If I were to capture a TLS session (and shared secrets) between myself and a web site operated by another party, could I later use the HMAC (or something else?) to verify to a third-party the ...
Dave Begonia's user avatar
3 votes
0 answers
258 views

Saving and verifying an HTTPS request [duplicate]

I want to save a web request and prove that it was signed by a specific certificate. What I want is the TLS equivalent of: -----BEGIN PGP SIGNED MESSAGE----- <!doctype html> <head> .... -...
Terence Eden's user avatar
0 votes
1 answer
116 views

Can I download a signeture of webpage on https protected connection? [duplicate]

Let's say that Malory owns an official website that now says that her birthday is on 25th of July. I can connect to that website by https, and SSL sertificate of the connection says "issued to ...
Arqwer's user avatar
  • 253
0 votes
0 answers
140 views

Is it possible to save a verifiable log of a TLS session? [duplicate]

Here's an example situation: I download a file from some server over https, but I also save a "log" of the TLS communication. Later, that file is removed from the server and nobody believes me when I ...
Matthew's user avatar
  • 161
1 vote
1 answer
94 views

Validate HTTPS traffic at later time [duplicate]

I want to capture HTTPS traffic, save it, and validate it at a later time. I want to ensure that at a later time I'm able to validate the HTTPS traffic using the certificate which was presented at the ...
user avatar
18 votes
5 answers
4k views

Why does HTTPS not support non-repudiation?

I stumbled into this recently for a specific project I had in mind. I thought HTTPS would prove that a given content actually came from the origin, by having its contents always signed before transfer....
rsp's user avatar
  • 191
9 votes
3 answers
1k views

Is it possible to store / record HTTPS client auth traffic as a signed document?

In a scenario where there are client RSA certificates (e.g. on a smart card), is it possible to record a form submission (or an AJAX request) in a form which makes it possible to later ascertain that ...
Ivan Voras's user avatar
1 vote
1 answer
232 views

Proving download via https

Suppose I download a file hxxps://example.com/somefile.txt with a client that logs everything, including short-term session keys. Do these logs constitute sufficient proof that the given file has ...
bohdan_trotsenko's user avatar
4 votes
1 answer
178 views

Why isn't the record of a TLS data application exchange signed by the server?

I am inspecting the TLS(1.2) protocol, and I notice that after the key exchange (handshake), data applications flows from server to client freely (because they have the session key). However, I ...
Tal-Botvinnik's user avatar
0 votes
1 answer
191 views

Can you use Https to prove document was sent from domain?

I'm aware that you can use tools like GPG to both encrypt and sign information. However HTTPS seems to only be used for encryption. The browser shows me the connection is secure, but there is no way ...
Jeremy French's user avatar
1 vote
1 answer
113 views

Is there a way to check later if a saved page originally served via HTTPS is legitimate?

If a page is served to me via HTTPS and the certificate is OK, I know that the page is authentic. What if I save the page? Can I check later if that page is authentic?
Guest's user avatar
  • 11