Superpolynomial subexponential runtimes. / Even though in practice it would take you several lifetimes, / If you ran it long enough you'd always find those two primes. / Superpolynomial subexponential runtimes -- Eric Hughes (2000)
In a series of lectures in 1938, tv inventor Philo Farnsworth explained the need to develop "the tools to make the tools to make the tools" to make high tech stuff. He originated the phrase.
Recording the TLS session doesn't work. The content is only authenticated with a symmetric session key. The content is not signed by the server's private key. Anyone can use the same session key to forge a different session with a modified webpage and new auth tags. The hash of the webpage is not signed by the private key. This is intentional. The protocol is not intended to bind the content to the private key.
Coming back to this 7 days later I think I understand what you mean.
The site content is authenticated with the symmetric key.
The symmetric key is authenticed with the private key.
That led me to jump to the conclusion that the content is transitively authenticated with the private key. But the security model of symmetric and asymmetric authentication schemes is of course very different. The server's private key is never disclosed so you cannot use it to forge the key exchange. But the symmetric key is of course shared and only defines a single level of trust: You either have it, meaning you can both verify messages but also sign arbitrary messages. For the purpose of transport security that is perfectly fine as both parties have full trust in each other for this purpose (the whole point is to guard the connection against anyone else), but for public authentication you need an asymmetric structure that allows verifying without the ability to sign. Symmetric cryptography by design does not enable this.
It is irrelevant that the symmetric key is authenticated with the server's private key because the presupposition that the symmetric authentication works is flawed. Verification by the untrusted public is a different scenario from verification by the two trusted parties of the communication and the presuppositions do not carry over.
During the early days of the Russian invasion in 2022, it was realized that almost all of Ukraine's redundant offsite backups were in various locations in Kyiv.
https://ssd.jpl.nasa.gov/tools/sbdb_lookup.html#/?sstr=2026%...
reply