I'm not sure if this question fits better in StackOverflowSE or CryptoSE but i think this is the right place.
In an online community portal I want to save users' private messages encrypted in a database so the information can't be leaked if someone gets access to the database. But I have no idea how to manage the keys.
When a message is sent it should be saved encrypted in the database and should only be decryptable if one of the participants is requesting the message. The key obviously must not be saved in the database as that would make the whole thing pointless.
The way I came up with is to save the message with a symmetric-key algorithm and save the key encrypted with a public-key algorithm for each participant (each user has a public key).
When a message is requested it is decrypted by using the user's private key to get the symmetric key. However I have no idea how to create/save a private key. It must not be in the database and due to the application being multi-platform (web, mobile access) I can't save it on the user's device and must be generated on the fly using a constant which comes from the user and is not saved somewhere in the database. The only constant I can come up with is the user's password. But in case the password is lost/forgotten there is no way to access the messages anymore.
My question: Is there another way to accomplish this? Or do you know of another constant which is still private?
Edit/Update: Thanks for your answers. Here is an update:
What about saving the private key in db encrypted with a random string that is sent to the user in a mail once at registration? The user is advised not to delete that mail. If she still does (seems quite likely) then I can blame her, well no j/k, but that would be at least one way to recover the messages.
Here a sub-question: The application can only be accessed via HTTPS or TCP/IP+SSL API. Is it save to en-/decryt the message on the server and send it in plain over SSL? Else I would have to look for implementations (like GPG) for all platforms (browser, mobile, desktop). This requires to store the private key in ram for the time the user is logged in (password is sent at session start/login). Sure if someone gets write access to the server (alter the application) or read access to the ram (o0) he could sniff the keys but I don't think this is likely.
The message must be *en*crypted on the server (means sent in plain) anyway as it possibly needs to be pushed to mobile devices by the server. (It's not important whether that's safe or not, I want to make sure noone can use a database dump - not if Apple or similar can read it while being delivered).
Probably I don't need any of this as my users most likely won't sent secret messages to each other but in case of a leak they won't be glad. It's a community for local students and you never know what bored CS students are up to ;).