Why do I even care? Friends, I enjoy and appreciate Stack Exchange. But my biggest problem with it bothers me. It is that generally I don't feel the love. I'm not free from emotions about this.
In the latest instance, I attempted to benefit myself and the Information Security Stack Exchange community by asking a relevant question to which I, and I presume others, would like to know the answer. First I searched for similar questions and read their answers. I found that I still did not have the understanding that I was seeking.
So I asked whether SSL/TLS implies that the transported document becomes signed. After a while, one person described a counterexample. Good. That's what I call an answer.
As I hope we all expect, this counterexample to the (thereby demonstrated false) claim that HTTPS signs documents is a specific scenario in which the document does not meet a criterion that we'd all call "being signed." As I'll state it here, the criterion is that the document must have a durable proof that someone has marked the document:
- that has the purported contents
- in a way that only the purported signer is expected to be able to do.
As usual with PKI, the scheme falls down if private keys don't stay private. OK, you can make the usual arguments for biometrics, etc., but that won't contribute very much to this particular discussion.
I didn't like what happened meanwhile. Various observations toward dismissing the question came up. I answered them. The question was downvoted. The question is now marked as a duplicate of how SSL/TLS works.
I am saying that it's not. I am saying that the counterexample is more than a statement of the criterion for being a signed document and more than a definition of SSL/TLS.
In case we're not all convinced, I offer an analogy. Suppose I had asked "Do there exist integers a b c each greater than zero and an integer n greater than two such that a^n + b^n = c^n?" Would I be duplicating "What are the usual axioms of arithmetic?" The fact that there are no such a b c and n is a consequence of those axioms and nothing more. Once the question was asked, it took just under 360 years for someone to explain how those axioms justify that consequence. Now that a few more years have gone by, there is more than one person in the world who understands how - possibly dozens of people!
Logical consequences are not generally obvious from the relevant definitions.
Fortunately my question isn't nearly as subtle as Fermat's Last Theorem. How subtle is it? I asked an intelligent person, who crucially is an undergraduate student not an established expert, whether after reading the answers to how SSL/TLS works he now knows whether SSL/TLS signs a document. After all, an expert would know the answer without bothering to read anything more about how SSL/TLS work. This undergraduate student did not know.
He was happy to argue that SSL/TLS is a bad way to attempt to sign a document. Yes indeed, I agree. If anyone wants to sign a document, that person should just use a tool designed for that purpose, such as GPG. But that wasn't what I was asking. And he did not know how to justify a claim either that SSL/TLS is not an effective way to sign a document or that it is an effective way.
Can we agree that the answer to my question is not simply obvious to everyone who has referred to the other question?