Is this design for storing/sharing secrets secure?

Question

Goals

I am implementing a web-based system which has the following goals:

1. Users are able to store secrets (could be password, or an entire file) on the server.

2. Server has no knowledge of the keys for decryption. So that if the server is compromised, the attacker would not be able to decrypt the secrets.

3. Secrets can be shared between users.

Design

The main threat I am concerned about for the purposes of this question is server compromise. I want to ensure that if an attacker gains access to the server or database (offline or online), no secrets are exposed. I understand there are other threats, like a compromised user account. Other safeties will be in place to protect against that.

I decided that it is safest for the server to never see a plaintext secret or the key material. Therefore, all encryption is done client-side. I am using asmCrypto.

1. HTTPS is used for all client/server communication. Users require accounts, there is already an authentication system in place.

2. Users generate a personal RSA key pair (2048-bit, e=65537). The private key is encrypted with AES-GCM using a PBKDF2-generated key based on the a user-provided passphrase. The AES nonce is generated by the server to guarantee uniqueness. The user's public key and the encrypted private key are sent to the server to be stored.

3. When a user saves a secret, they generates a random unique key (K) for that secret. They encrypt the secret with AES-GCM using K and a server-provided nonce. Then they encrypt K using their own public key and OAEP padding. Additionally, they may encrypt K with another user's public key. The encrypted copies of K are sent to the server.

4. To read the secret (possibly from another computer), a user must retrieve their encrypted private key from the server. They decrypt their private key client-side by providing a passphrase, which is fed into PBKDF2 to generate the AES key. Once their RSA private key is decrypted, they can decrypt the secret key (K), and subsequently the secret.

Questions

I know there are many pitfalls and potential gotchas with encryption. I've done a lot of reading to try to understand how best to use these algorithms (for instance, the unique nonce for AES-GCM, the value of e for the RSA keys, and the importance of using proper padding). However, I'm not entirely confident this is a sensible design.

What flaws do you see in this design?

Are the choices of algorithms and parameters sound?

Is there any way to judge the quality of the asmCrypto library?

Am I missing a simpler, obvious solution?

Answer 1

Issue with Trusting the Server

If you base the web-app on the server, then when the server is compromised, the base web page or the crypto library can be compromised/bypassed directly without alerting the users.

Your infrastructure is built upon a bed of sand if you cant trust the server.

Attacks:

• Remove encryption totally and have the content unencrypted, the users still use the software expecting it to be encrypted, but it isnt. (complications being the current encrypted content)
• Or to just send the 'secret' to the attacker directly.

The whole Javascript Cryptography Considered Harmful issue documents this and other issues. Note: That this article mentions the secure notes use case.