We have a web application which is used to store secrets (passwords, pins etc) and share them to other system users.

Currently for encryption we use AES with single encryption key, and all secrets after encryption are stored in DB. After reading about possible methods to make this better, I have decided to implement method described in https://security.stackexchange.com/a/91850/65915 (keys are stored on server, and server manages them)

When using this approach, I do not want to make users enter their private key passphrase each time they want to perform an action, therefore I have to store it during user session.

System currently uses JWT tokens, so I have a plan to add their passphrase encypted with AES into it, and during request server can decrypt it and unlock their private key to perform actions.

Is this method secure enough, or there's even a better way to solve this problem?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.