I am developing a service that will keep personal information about a specific user, which should only be accessible by the author and the intended recipient. I want to encrypt the data on the client-side and store the encrypted version on the server.
Research suggests using , but this is ideal for secure storage of an individual user's data.
Issue
In my service, other users need to input data that must remain confidential between them and the recipient - how can client-side encryption achieve this?
Is it feasible to accomplish this entirely through client-side operations?
Update
Upon further review, I believe achieving this solely on the client side may not be possible. Here is a potential approach:
All communication is secured via SSL connection
- Generate RSA keys, encrypt the private key with AES (using a salted passphrase)
- Salt generated in the browser
- Store the passphrase salt, public key, encrypted private key on the server
Encrypt all user data with their public key, requiring them to decrypt their private key in-browser by entering their passphrase, then use the RSA private key for decryption
If a user wants to share data with another, encrypt the data with the recipient's public key
Is the proposed method secure?
Here is an example of what would be stored on the server:
+----------+---------------------+---------------+
|Public Key|Encrypted Private Key|Passphrase Salt|
+----------+---------------------+---------------+