Hybrid key exchanges for double-hulled encryption

A system, comprising:

• one or more processors;
• memory that stores computer-executable instructions that are executable to cause the one or more processors to:
• establish a cryptographically protected communications session by at least:
• obtaining, from an other system, a first cryptographic material;
• transmitting, to the other system, a second cryptographic material to allow the other system to derive a first cryptographic key based on the first cryptographic material and the second cryptographic material and to derive a second cryptographic key based on the first cryptographic material and the second cryptographic material;
• derive the first cryptographic key based on the first cryptographic material and the second cryptographic material and derive the second cryptographic key based on the first cryptographic material and the second cryptographic material;
• perform a cryptographic operation on a datum using the first cryptographic key to create a first cryptographically protected datum;
• perform the cryptographic operation on the cryptographically protected datum using the second cryptographic key to create a second cryptographically protected datum;
• and
• transmit the second cryptographically protected datum over the cryptographically protected communications session.

A non-transitory computer-readable storage medium storing thereon executable instructions that, as a result of being executed by one or more processors of a system, cause the system to at least:

• establish a cryptographically protected communications session by at least communicating with another system such that both the system and the other system are able to use a first cryptographic material and a second cryptographic material;
• derive a first cryptographic key based on the first cryptographic material and derive a second cryptographic key based on the second cryptographic material;
• perform a cryptographic operation on a datum using the first cryptographic key to create a first cryptographically protected datum;
• perform the cryptographic operation on the first cryptographically protected datum using the second cryptographic key;
• and
• transmit a result of the cryptographic operation on the first cryptographically protected datum over the cryptographically protected communications session.