This question already has an answer here:

If I were to add additional encryption inside my HTTPS stream, would I be making worthwhile improvements?


The NSA stores a massive amount of data, perhaps most of it is encrypted and at some later date they may be able to decrypt it.

Possible solution:

Generate a private/public key pair on the server, use the public key client side to encrypt the sensitive data and send back to the server over HTTPS.

This means that you're encrypting it twice with public key cryptography, once with HTTPS and a second time via a library such as Stanford Javascript Crypto Library

In the case that the SSL certificate is compromised, the second layer of encryption protects your data.


I am not asking how to do this, I am asking is it worthwhile to do this? Another way of asking this question is:

"If SSL is compromised by the NSA now or in the future, and we know that the NSA is collecting all the internet traffic, is it wise to add another layer of encryption?"

marked as duplicate by Steffen Ullrich tls Nov 8 '16 at 5:10

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


A bit opinion-based, but I'd say No.

If the NSA can read TLS because an error in the protocol and/or implementation: While TLS has and had problems, it also has the whole world using it. Homebrew solutions are unlikely to be better.
(To start with, This means that you're encrypting it twice with public key cryptography is wrong. TLS doesn't encrypt the whole data with a public-key-scheme. That would be insane.)

If the NSA can read TLS because they have enough compuation power to crack everything in a reasonable time: One or two times doesn't make much difference anymore.

If the NSA is using malware, bribes etc. to get access to certificates and/or directly inject something to Apache etc., another layer of transport encryption won't help.

And so on...

Not the answer you're looking for? Browse other questions tagged or ask your own question.