I am currently building a system (PHP Web Application Framework) that creates an RSA Key Pair for a user to allow other users to send secure information from one to another. The public key is unencrypted (as expected) and the private key is encrypted with the users password. As the initial RSA generation process is quite computationally expensive (generation of large primes), I am using two methods to make the primes.
The first is a java applet that runs on the clients browser, creates the primes and keys, secures the private key with the password, and sends it back to the system where it is stored and used later.
The second is to use an application (running on the web server as a cron or on another server that can access and update the app) which will do the same as the applet. However, I am still not sure about how to secure the private key so it is only accessible to the user, and it can't be accessed by anyone else.
Sadly, this is where I am hitting a road block. I am unsure of how to secure the data (either generated on the web server or by another server), so it (or the users password) is not directly or indirectly available to any hackers, even if they have access to the entire file system and database on the server. Does anyone have any suggestions on how something like this could be achieved?