Timeline for Assure Integrity and authenticity
Current License: CC BY-SA 3.0
3 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 12, 2017 at 14:52 | comment | added | mat | Of course, TLS guarantees integrity along with authenticity (of the communication partners who participated in the hadshake). If you servers gets completely compromised and the attackers are able to steal your long term TLS certificate keys along with short term symmetric keys from the memory, than all other measures you devise inside the tunnel will probably fail, too. There might be special circumstances under which encrypting & authenticating data within a TLS tunnel can make sense, but your question doesn't state those. What is your actual use case? What is your threat model? | |
| Jul 12, 2017 at 10:19 | comment | added | rew1nd | If the server certificate is compromised, a hacker can get autenticoty and do man in the midle. Besides that, TLS, does not garantee integrity. If i have the symmetric or both assimetryc key, and the cipher text, and can decrypt, change it , encrypt and send it again, with no trace of changes! So i think i need another method for assuring integrity, with hash key values. | |
| Jul 11, 2017 at 19:38 | history | answered | mat | CC BY-SA 3.0 |