1
$\begingroup$

Suppose I've got a response from a website using https. Is it possible to store the certificate and keys exchange to prove to a third-party that the response came from that domain?

$\endgroup$
1

1 Answer 1

1
$\begingroup$

No, at least for standard ciphersuites, TLS/https does not allow proving to a third party that an https payload was received from a certain domain.

Problem is, the initial TLS handshake leads to symmetric keys known by both parties, used to secure the rest of the exchange. Thus each party can forge messages and pretend the other side sent them.

$\endgroup$
1
  • $\begingroup$ That's exactly what I first thought about it. The private/public keys are used only to verify the identity, then a symmetric key is exchanged, and the remaining payload is encrypted with the symmetric key. $\endgroup$
    – msbrogli
    Aug 29, 2018 at 5:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.