If a server and I had the possibility to sign the encrypted messages we exchange, would it still be useful to use TLS?

Question

Assume to neglect:

• The man in the middle attack.
• The efficiency of symmetric encryption over asymmetric

I can't understand the usefulness of TLS, with respect to the security, if both parties exchange encrypted and signed messages (i.e <ciphertext, signature>) without TLS.

• Is the security communication using TLS the same as send <ciphertext, signature> without TLS?

• Is send a message under TLS more resilient to traffic analysis against send <ciphertext, signature> without TLS?

E.g., if I send an encrypted ballot (ElGamal) to a voting infrastructure, can additional TLS encryption be useful to further keep an ISP from knowing what I am sending?

Answer 1

TLS (with proper ciphersuites) has numerous advantages compared to just encrypting and signing every individual message:

1. It prevents attacks that suppress, replay or reorder individual messages/packets (e.g. allowing an adversary to replace a "no" answer by a former "yes" answer that's replayed; or making one party believe that a message it sent was received by the other party, when really it was suppressed).

2. It gives forward secrecy, that is security w.r.t. confidentiality of past communications should a party leak their private keys in the future.

3. When only one party (e.g. server) has a private key, TLS still allows encryption in both directions (because it uses asymmetric key exchange).

4. The computational effort and amount of data exchanged are lowered in typical usage with many messages. That's because the relatively expensive asymmetric cryptography is used only at session establishment, then more efficient symmetric authenticated encryption can be used for the rest.

5. TLS typically comes with an infrastructure that automates the authentication of a server, by proxy of a certification authority.

   Note: However the security level of that authentication typically is fairly low. That's because it relies on any of so many certification authorities that a state-level actor or even organized crime likely can subvert one authority and obtain rogue certificates. When that authentication is insufficient, it arguably gives a false sense of security. That would be much of a problem for e.g. a political voting application involving Javascript in a browser.

---

Is sending a message under TLS more resilient to traffic analysis?

Yes, because the whole traffic is encrypted and signed (including e.g. Javascript code sent by a server). It's far from perfect though, even disregarding the certificate infrastructure's low security: the ISP still can get the IP address of the web server, typically it's FQDN (crypto.stackexchange.com for the present page), the size and exact timing of all interactions, including queries. E.g. in an online voting application, even with TLS, the ISP likely could still tell if a vote has been cast from a given device.