We have a web application which is used to store secrets (passwords, pins etc) and share them to other system users.

Currently for encryption we use AES with single encryption key, and all secrets after encryption are stored in DB. After reading about possible methods to make this better, I have decided to implement method described in https://security.stackexchange.com/a/91850/65915 (keys are stored on server, and server manages them)

When using this approach, I do not want to make users enter their private key passphrase each time they want to perform an action, therefore I have to store it during user session.

System currently uses JWT tokens, so I have a plan to add their passphrase encypted with AES into it, and during request server can decrypt it and unlock their private key to perform actions.

Is this method secure enough, or there's even a better way to solve this problem?


You must log in to answer this question.

Browse other questions tagged .