# If a server and I had the possibility to sign the encrypted messages we exchange, would it still be useful to use TLS?

Assume to neglect:

• The man in the middle attack.
• The efficiency of symmetric encryption over asymmetric

I can't understand the usefulness of TLS, with respect to the security, if both parties exchange encrypted and signed messages (i.e <ciphertext, signature>) without TLS.

• Is the security communication using TLS the same as send <ciphertext, signature> without TLS?

• Is send a message under TLS more resilient to traffic analysis against send <ciphertext, signature> without TLS?

E.g., if I send an encrypted ballot (ElGamal) to a voting infrastructure, can additional TLS encryption be useful to further keep an ISP from knowing what I am sending?

• Signing is not encryption. Signing does not protect the plain text against sniffing at all, it only proves who send the message. Aug 27, 2022 at 10:59
• @SteffenUllrich I know. I mean both parties first encrypt the message, then sign it and finally send (ciphertext, signature) to the other party. Does TLS, on the other hand, protect against sniffing? Aug 27, 2022 at 11:30
• "Assume that the client trusts the server, (i.e. it does not need its certificate " - that's not the point of the server certificate. The certificate is used to make sure that the client actually communicates with the expected server and not with some man in the middle. Aug 27, 2022 at 12:47
• thanks for the advices Aug 27, 2022 at 13:13

TLS (with proper ciphersuites) has numerous advantages compared to just encrypting and signing every individual message:

1. It prevents attacks that suppress, replay or reorder individual messages/packets (e.g. allowing an adversary to replace a "no" answer by a former "yes" answer that's replayed; or making one party believe that a message it sent was received by the other party, when really it was suppressed).

2. It gives forward secrecy, that is security w.r.t. confidentiality of past communications should a party leak their private keys in the future.

3. When only one party (e.g. server) has a private key, TLS still allows encryption in both directions (because it uses asymmetric key exchange).

4. The computational effort and amount of data exchanged are lowered in typical usage with many messages. That's because the relatively expensive asymmetric cryptography is used only at session establishment, then more efficient symmetric authenticated encryption can be used for the rest.

5. TLS typically comes with an infrastructure that automates the authentication of a server, by proxy of a certification authority.

Note: However the security level of that authentication typically is fairly low. That's because it relies on any of so many certification authorities that a state-level actor or even organized crime likely can subvert one authority and obtain rogue certificates. When that authentication is insufficient, it arguably gives a false sense of security. That would be much of a problem for e.g. a political voting application involving Javascript in a browser.

Is sending a message under TLS more resilient to traffic analysis?

Yes, because the whole traffic is encrypted and signed (including e.g. Javascript code sent by a server). It's far from perfect though, even disregarding the certificate infrastructure's low security: the ISP still can get the IP address of the web server, typically it's FQDN (crypto.stackexchange.com for the present page), the size and exact timing of all interactions, including queries. E.g. in an online voting application, even with TLS, the ISP likely could still tell if a vote has been cast from a given device.

• Thank you very much for your response. Besides the advantages you mentioned, is send a message under TLS more resilient to traffic analysis (e.g. done by a malicious ISP) against send <ciphertext, signature> without TLS? Aug 27, 2022 at 13:16