TLS - self encrypting to avoid tls setup, secure?

Question

I am in doubt : of course one can create a tl connection between a client and a server.

But what if the client sends self encrypted with, say, blowfish, data to the server? The goal is that the server remains dumb about tls.

The question is not if it is possible, it is.

But in case of a "unattended listening by someone who might love hats", would that be secure enough if the hacker gets the packet?

Would it lessen the security ?

To me, maybe yes, because the hacker would have the packet on his/her computer with the speed involved vs hacking a tls connection. But am I correct ?

Edit : I am new to the security context.

Answer 1

It depends!

Any of the two alternatives TLS or directly symmetric encryption with a pre-shared key will of course require the sender (him/herself) to encrypt the data.

From a cryptographic perspective any statement about security/"being secure" even relative often requires specifity and not much about the actual ciphers are stated. that is why the answer is that it depends.

As much as it depends there are some points which might have some more general application.

TLS will be a stepwise procedure and use first asymmetric encryption (that with public and private keypair) to establish a secure channel. In another step it will then use this rather expensive/slow channel (because it takes more calculation power per transmitted data) to exchange a session key that is used for symmetric encryption. At this point you are at the point at which I assume your suggestion starts and that is that, you have a key only known to the legitimate sender and receiver.

Given that the symmetric encryption following a TLS initial handshake/sessionkey exchange is having the same attributes as the one you suggest with the "self"encrypted setup than there is no reason to see any difference in "security".

Indeed if you know were able to have a shared key for symmetric communication available on both ends of your communication, then this means no need to exchange a session key via asymmetric pub/pri-key encryption in the first place. At best with directly using symmetric encryption any vulnerabilities in the asymmetric part of the TLS can be avoided.