Hello there for an online Tool which offers the feature of storing passwords online I want to implement the following process:

  1. A user is generating a secure secret random key with Javascript

  2. This key is saved within the users browser but never transfered online

  3. If a user saves a new password, the password is encrypted client-side with Javascript using the users key

  4. The encrypted password is transferred (via SSL anyway) to the online key storage and saved there

  5. If a user needs one of the saved passwords it is transfered back to the users browser and decrypted client-side with Javascript with the users secret key

Therefore even in case of MITM or even if the server is compromised the data for a possible attacker is useless.

How can I store such a secret key in a local browser (do you know a good possibility) and how can i export the key?

Thanks for your help!

  • 3
    Blackbam, can you cut this down to one question (and make that not your number 1 as it would be closed as opinion based) – Rory Alsop Sep 16 '15 at 14:43
  • 1
    Does it need to be browser-based? Have you investigated systems like Apple's Keychain and Google's Smart Lock? Does LastPass' model (which appears to be similar to what you describe) meet your requirements? It would be helpful if you included the research you have performed and the potential solutions that you have rejected. – schroeder Sep 16 '15 at 15:14
  • What secure random number generator do you plan to use for step 1? Browser-based cryptography and key generation is more complicated than it seems. See nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/august/… – mti2935 Sep 16 '15 at 20:15
  • Yes the solution has to be browser based as it is part of a bigger web application which is already existing. The secure random number generator is not decided yet however thanks for that hint @mti2935 – Blackbam Sep 17 '15 at 23:51

I don't think that anyone can state whether the security of an encryption scheme is safe without knowing how the key will be managed.

As far as asking how to manage the key, storing the only copy of a key in something as ephemeral as the browser's data seems a big mistake. You're one hard drive failure away from losing the key to all of your data. Too risky.

I think that you need to do one of two things:

  1. Create the key from a user's pass phrase using something like PBKDF2.
  2. Encrypt the master key using a password from the user and store that key on the server.

There are already many systems that do something of this sort; including open source options like KeePass. They can be integrated with existing file sharing services like Dropbox to handle the storage and distribution problems. I mention this because of the fact that it is generally better to use well-tested security code than write your own. Keepass has already worked on quite a lot of security issues.

  • From the OP's description, it appears that a KeePass/Dropbox model would work (I was going to suggest it), but it also appears there is a hidden requirement to have the convenience of the password auto-filled in the browser (and possibly that the asker wants to code it himself). – schroeder Sep 16 '15 at 15:11
  • @Schroeder - Keepass has browser integration via extensions. – Neil Smithline Sep 16 '15 at 15:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.