A client is communicating with a server through https, which should provide them with the security they need. I would like to add an extra layer of security.
The protocol would look something like :
The 128-bit symmetric key is stored in the backend file on the server.
Client connects to the server's IP address using https:// and logs in using a password (or PKI authentication)
client is shown HTML with one input box in which he has to type the symmetric key, which is then locally stored as a js variable in the browser.
All data that is exchanged by the client and the server is being encrypted/decrypted using the symmetric key for AES-CBC.
Can you think of attacks that would enable an attacker to read a message that is sent between the client and the server?
One example of why this extra layer can provide extra security: Let's say the attacker gets a hold of a certificate that is trusted by the client, and acts as the server. He would still not be able to read the messages sent by the client.
P.S. To clarify: the same symmetric key would be used for every session, as it is the one that is fixed and stored on the server. A random IV is used for each AES-CBC encryption, and is sent along with the encrypted message.