I've started yet another project to solve "the right key" problem.
DetecTor is an open source project to implement client side SSL/TLS MITM detection, compromised CA detection and server impersonation detection, by making use of the Tor network. In short, make use of the existing Tor network, perform multiple connections to the destination server through multiple routes, check for consistency in the use of certificates, and either fail or proceed automatically, without user interaction. The detailed description of the idea, including suggestions for the handling of edge cases, can be found at http://detector.io/ I propose to create an implementation that transparently integrates this functionality into the NSS library, without requiring application changes. (Trigger the probing on the application's attempt to connect, delay the connection by returning the "would block" status until the probing has completed, then fail early if the probing result isn't satisfactory.) Activation of this new behaviour could potentially be driven by an environment variable or by a compile time option. (Details or alternate integration proposals can be discussed at a later time, once this project move forward.) In order to make this approach possible, we must tunnel TLS connections through a SOCKS5 proxy (which is the interface the existing Tor project software offers). I've ported Necko's SOCKS5 C++ implementation to plain C and propose it for integration into either NSS or NSPR, see https://bugzilla.mozilla.org/show_bug.cgi?id=916947 Looking forward to your feedback. Regards Kai -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
