I am concerned about the hacking of a root CA and want to buy 3 SSL certs from completely different providers who will independently validate my identity. Then at presentation time, I will send all 3 "certifications" to the client.
What approaches exist to accommodate this need from either a protocol perspective, or crypto (where the keys are joined in some way)?
- An existing HTTP web client, chrome extension, or SOCKS/Proxy that does additional validation
- A proof of concept for another implementation not yet invented (e.g. a new version of TLS incorporating new encryption)
The possible solutions I've thought of include:
Client makes 3 HTTPS requests, where each request is encrypted with a different certificate. The response should be a random number that is equal in all 3 responses.
2 keys are signed and contain a x509 custom field that references the serial number of the "validated" certificate
The keys are mathematically combined in an interesting way that reduces the multiple requests into a single request. (RSA or ECC/Subgroups)
Does such a protocol exist in draft form anywhere?
Is there a way to mathematically combine the validation of N certificates without losing security?
a. I'm interested in crypto that authenticates me 3x as a web host
b. Increases the integrity of the data with a 3x signed data stream
c. Increases the privacy of the data with 3x the encryption
(Note I know DANE might satisfy part of this requirement, but I'm looking for a non DANE / HTS solution)