I got fun idea how to increase the security of the SSL (TLS) for websites. However I think there is no support for it in the browsers, so I thought I could add it eventually, but have no idea if it's supported.
Currently SSL works the way that there is always some English language country based company issuing certs based on their root key. Now this is all in the control of the goverment, because they can gain access to these keys upon request, and they have agreements to do it. However, for business this is not good enough, definitely.
So the thing is now to simply use double or more SSL connection one wrapping each other, and you would use two or more certificates, one issue by UK and one by China.
By having the public part of root keys from China and UK and do double encryption would make it unbreakable for both US and China.
Since Chinese root keys are included in Firefox, the only thing missing here is support for double-encryption.
This is seriously good model, because:
- All user browsers have two public parts of public key
- There is no way, that Chinese and US/UK would ever share their secret keys
This can be done by using open source browser like Firefox. It simply works the way, that connection is encrypted twice.
Just the domain negotiation is difficult. Either using two certs for a same domain, or using two domains, or using name similarity, or maybe sign the sub-domain in the name, and combine into two certs. Chaining with DNSSEC, or just same names, would be enough for example to establish communication between two parties, e.g. between UK and China.
UPDATE: It seems that the Chinese cert in FireFox is not secure, therefore there are no other certs or countries which could deliver this. But if the Chinese key is secure, simply be negotiating the domain, one could have a seriously encrypted connection and be government-proof, but if the all keys are shared, I'm left only with self-signed certs.
Seriously, maybe using self-signed cert is really more secure for a long-term customer, than actually government-controlled one? So maybe following scenario: "Please install our cert if you are paranoid about government". So this should be good as VPN. For doing business, like email, companies would have to exchange the certs, in order to achieve this level of security. So just an SMTP hub would be secure like this if done properly, if the customers would install the cert, and upload theirs, they could securely communicate with each other.
Therefore, the official, government-controlled certs are no use for secure communication, and it's better to use self-signed ones, and the certs can be downloaded and installed no problem via the browser. No encryption is required to transmit the public part (the root public key), and after confirmation of the known hashkey / picture, you can browse resource. The only thing is to do it properly, like first to install certificate, and then visit the website, and the cert would be fully valid. So you can approach the problem with private PKI instead relaying on the official and this is hopefully fully legal.