I would like to ask what encryption options are available for the following real scenario:
- There is an unsecure, full-duplex communication channel between a server and client
- There is also a secure one-way communication channel from the server to the client
From this it is sought to have secure full-duplex communication. The existence/timing of messages is not considered a liability in/of itself.
The motivating scenario is:
- A software application with a user-interface including an embedded web-browser
- The native application code interacts with the web application using http WebSockets (this is the unsecure, full-duplex communication channel). The native application contains the server and the web application contains the client.
- There is no other means of communication between the native application code and the web application.
- In this scenario, Websocket over https is not considered an option due to the certificate management complexity.
Edit: additional details:
- The system must work offline