I want to store passport copies safely in a database, the database itself is a normal MySQL database and on a somewhat trusted web server. The user who owns the passport copy should only be able to upload his or her passport not view it. The approach I want to take consists of the following steps.
- System administrator opens page via https
- Administrator submits a generated public key to the server and stores private key locally (on smart card or something not permanently attached to computer preferred)
- User opens page via https
- User selects passport copy (image) in browser and submits it to the server
- The server encrypts the image with the public RSA key and stores it in the database column
- Server overwrites any unencrypted copy in memory
- Admin opens page via https
- Server loads encrypted column and sends the encrypted image via AJAX to the admin browser
- The admin's browser loads the private key from a file or smarcard and decrypts the image using https://www.pidder.de/pidcrypt library
- The unencrypted image data is injected into the src attribute of a image tag.
(I have not yet found a good way to load the private key in the browser)
- If the server is hacked and the database downloaded by the attacker, are the passport copies then safe?
- Is there a better way to ensure the copies are safe?