4 ms·
I thought that HTTPS already provides all the proofs that message originated from a particular server. Why isn't it enough to capture some additional crypto inf
by vbezhenar 5y ago
I thought that HTTPS already provides all the proofs that message originated from a particular server. Why isn't it enough to capture some additional crypto information from HTTPS protocol?
- flumpcakes 5y agoHTTPS does not mean that a message came from the particular server you assume it does. For example, most CDNs will be acting just like a MITM in order to operate. Having a separate signature that can verify the HTTP _content_ is from the origin server, regardless if it gets re-encrypted by other services en route, is probably useful.
- NovemberWhiskey 5y agoTLS will provide assurance of client identity as long as there's no intermediate termination; like (say) TLS inspection, an API gateway, a CDN or an L7 load balancer. This specification allows the use of TLS for per-hop confidentiality with end-to-end assurance of identity.