= TLS termination moves the confidentiality boundary
{c}
Suppose <client> A uses a protected channel to proxy P, which reads the message and sends it over a second protected channel to service B. Even if both channels protect against outsiders, P has the plaintext by construction. Therefore the conjunction of those channel protections does not imply <cryptographic confidentiality> from P. This counterexample does not imply that P is unauthorised; it identifies a trust assumption that application designers must state.
Back to article page
