Timeline for Is it safe to sign message with a TLS private key?
Current License: CC BY-SA 4.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 22, 2022 at 18:22 | comment | added | Maarten Bodewes♦ | I'm wondering how the signature is going to be checked. How to handle the key management is the trick, and it is also where possible issues lie - especially you haven't indicated how the corresponding public key is going to be trusted. If the key management is handled properly then it could possibly add a bit of security. If the key is compromised then both the signature for TLS authentication and HTML signing will become compromised, but that's OK if they are used for about the same purpose. | |
| Apr 22, 2022 at 14:05 | comment | added | Zac67 | If the server is compromised so that malicious code can be injected, the server's private key for SSL is likely compromised as well. | |
| Apr 22, 2022 at 11:08 | comment | added | DannyNiu | I think your usecase can be covered with subresource integrity don't you think? | |
| Apr 22, 2022 at 9:28 | answer | added | Arnaud Bouchez | timeline score: 2 | |
| Apr 22, 2022 at 8:36 | answer | added | Vic | timeline score: 1 | |
| Mar 25, 2022 at 11:04 | comment | added | real-or-random | What kind of private key is it? Is it an ECDSA key? I hope so. ;) Or is it an RSA key? | |
| Mar 23, 2022 at 13:02 | history | asked | fadedbee | CC BY-SA 4.0 |