I would like to ask what encryption options are available for the following real scenario:
- There is an unsecure, full-duplex communication channel between a server and client
- There is also a secure one-way communication channel from the server to the client
From this it is sought to have secure full-duplex communication. The existence/timing of messages is not considered a liability in/of itself.
The motivating scenario is:
- A software application with a user-interface including an embedded web-browser
- The native application code can inject javascript into the web-browser for execution (this is the secure one-way communication channel)
- The native application code interacts with the web application using http WebSockets (this is the unsecure, full-duplex communication channel). The native application contains the server and the web application contains the client.
- There is no other means of communication between the native application code and the web application.
- In this scenario, Websocket over https is not considered an option due to the certificate management complexity.
Edit: additional details:
- The client webapp only receives the port number when the server begins listening on that port (the port number being conveyed via javascript injection which initiates the WebSockets connection). This (I believe) mitigates server authentication needs. Client authentication is still wanted.
- The system must work offline
- The HTML/javascript of the web application is fully trusted.