Digital Evidence Generation in TLS-Protected Network Flows: An Experimental Evaluation

Abstract

Modern network infrastructures are highly vulnerable to security incidents that require robust forensic investigation in case of intentional or unintentional events. Traditional monitoring tools can capture network traffic and reconstruct communication events, but they cannot provide cryptographically verifiable proofs of the origin, integrity, and authenticity of the collected data. Even though the TLS protocol provides authentication, confidentiality, and integrity of the data in transit, it does not offer proof of origin. This limitation becomes critical when the intercepted traffic must support incident reconstruction and attribution of responsibility. To create digital evidence for TLS records, we propose an Auditor, which monitors a TLS endpoint to create digital evidence for the exchanged TLS records. From a practical perspective, we implement an application-layer solution consisting of a Digital Evidence Creator and a Verifier. These components synchronize over predefined fixed time windows and leverage network monitoring and cryptographic signing of TLS-protected flows, using a technique based on Merkle trees. Through controlled testbed microbenchmarks, we experimentally evaluate the scalability and performance of the digital evidence generation and verification under varying traffic rates, tree depths, capture intervals, and signature algorithms, considering both classical and post-quantum schemes. The results show that the algorithmic components scale predictably, while the main limitations are operational, providing a basis for future optimizations towards production-ready implementations.