2
$\begingroup$

So after SSL handshake the master secret is used to securely transfer data encrypted using symmetric cryptography. My question is simple: after SSL handshake, when the server (for example my bank) sends to me message encrypted symmetrically, is the message body (when my computer decrypts it) signed by server's public key or not?

SECOND QUESTION: If answer to question 1 is yes, then if I would receive some data (for example my bank statement) from the server, could I present this data signed by trusted server's key (bank's key) to some third party to prove that this data originated from particular company (because it's signed by asymmetric key that this company is using)?

THIRD QUESTION: If answer to question 1 is yes, then does the message (when decrypted symmetrically) received from server (after handshake) contains timestamp which could be used to prove, in the way similar to one presented in QUESTION 2, that this message originated at this-and-this time (for example a week ago)?

Improve this question
$\endgroup$
2

1 Answer 1

Reset to default
2
$\begingroup$

..., is the message body (when my computer decrypts it) signed by server's public key or not?

It's not signed. The "message body" (i.e. application data) is only protected by a HMAC. This HMAC relies on a shared secret known both to client and server created together with the encryption key based on the pre-master secret generated during the key exchange. Given that client and server have both the same key for encryption and the sane secret for HMAC the client might create any encrypted application data itself. This means it is impossible for some third party to figure out if the application data in some packet capture originated from the server or was faked by the client.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.