Leveraging transport-layer cryptographic material

1. A computer-implemented method comprising:

establishing a communication channel between a first application and a second application using a cryptographically protected transport layer;

acquiring a shared secret and a session key that are produced as a result of establishing the communication channel using the cryptographically protected transport layer;

deriving an application-layer cryptographic key based at least in part on the shared secret;

receiving encrypted application data from the second application, the encrypted application data encrypted with the application-layer cryptographic key and the session key;

decrypting the encrypted application data with the session key to produce intermediate encrypted data;

decrypting the intermediate encrypted data with the application-layer cryptographic key to recover plain text application data; and

providing the plain text application data to the first application.

2. The computer-implemented method of claim 1 , further comprising:

encrypting a plaintext reply with the application-layer cryptographic key and the session key to produce an encrypted reply; and

sending an encrypted reply to the second application via the communication channel.

3. The computer-implemented method of claim 1 , further comprising applying a key derivation function to a the shared secret to produce the application-layer cryptographic key.

4. The computer-implemented method of claim 1 , wherein:

the communication channel is a cryptographically protected communication channel that exchanges data using a symmetric cryptographic key; and

the symmetric cryptographic key is based at least in part on the shared secret.

5. A computer system, comprising:

one or more processors; and

memory storing instructions that, if executed by the one or more processors, cause the system to:

establish a connection to an application on another computer system in accordance with a cryptographically protected communication protocol;

acquire a shared secret and a session key that are produced as a result of establishing the connection in accordance with the cryptographically protected communication protocol, the shared secret accessible to the application and the system;

derive an application-layer cryptographic key based at least in part on the shared secret;

receive encrypted application data from the application, the encrypted application data encrypted with the application-layer cryptographic key and the session key; and

acquire plain text application data by at least decrypting the encrypted application data with the session key and the application-layer cryptographic key.

6. The computer system of claim 5 , wherein:

the cryptographically protected communication protocol is a version of the transport layer security protocol; and

the application-layer key matches a transport layer security session key associated with the transport layer security session.

7. The computer system of claim 5 , wherein the instructions further cause the system to:

derive an additional application-layer key based at least in part on the shared secret and a pre-shared secret associated with an application; and

provide the additional application-layer key to an additional application.

8. The computer system of claim 5 , wherein the instructions further cause the system to:

identify a piece of application data;

generate encrypted application data by encrypting the piece of application data with the application-layer key and the session key; and

transmit the piece of application data to the application via the connection.

9. The computer system of claim 5 , wherein the instructions further cause the system to:

receive encrypted application data from a transport layer that implements the cryptographically protected communication protocol; and

decrypt the encrypted application data with the application-layer key.

10. The computer system of claim 5 , wherein the instructions further cause the system to:

store a copy of the application-layer key;

receive a digital signature from the application; and

verify the digital signature using the copy of the application-layer key.

11. The computer system of claim 5 , wherein the instructions further cause the system to:

receive the encrypted application data via the connection, the encrypted application data encrypted with a public cryptographic key of an asymmetric key pair; and

decrypt the encrypted application data using a private key of the asymmetric key pair.

12. The computer system of claim 5 , wherein the instructions further cause the system to:

decrypt the encrypted application data with the session key to produce intermediate encrypted data;

encrypt the intermediate encrypted data with a second session key associated with a cryptographically protected communication session to produce re-encrypted data; and

send the re-encrypted data over the cryptographically protected communication session.

13. A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:

establish a network connection between a first application on the computer system and a second application on another computer system, the network connection being in accordance with a cryptographically protected communication protocol, the network connection having an associated session key and a shared secret;

determine a cryptographic key based at least in part on the shared secret;

receive encrypted application data from the second application, the encrypted application data encrypted with the cryptographic key and the session key; and

acquire plain text application data by at least decrypting the encrypted application data with the session key and the cryptographic key.

14. The non-transitory computer-readable storage medium of claim 13 , wherein:

the cryptographically protected communication protocol exchanges data using a symmetric cryptographic key; and

the shared secret is a generated as part of a Diffie-Hellman key exchange algorithm.

15. The non-transitory computer-readable storage medium of claim 13 , wherein the cryptographic key is derived at least in part by applying a key stretching function to the shared secret.

16. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions further include instructions that cause the computer system to verify the encrypted application data by verifying a digital signature on the encrypted application data.

17. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions further comprise instructions that, as a result of being executed by the one or more processors, cause the computer system to:

identify a characteristic of the shared secret; and

select a key-generation algorithm to generate the cryptographic key based at least in part on the characteristic of the shared secret.

18. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions further comprise instructions that, as a result of being executed by the one or more processors, cause the computer system to:

identify a cryptographic algorithm used to generate the encrypted application data; and

generate the cryptographic key from the shared secret using a key generation algorithm that is based at least in part on the cryptographic algorithm.

19. The non-transitory computer-readable storage medium of claim 13 , wherein the encrypted application data is received as a parameter of a Web page within a Uniform Resource Identifier.

20. The non-transitory computer-readable storage medium of claim 13 , wherein:

the application is a plugin operating in a Web browser; and

the cryptographic key is stored in a memory accessible to the plugin.