Storing encrypted data readable only by user but created by server

Question

Context

I'm actually creating an automated security scan application, meaning that every user will be able to scan their own website (the property verificationpart is done) and get flaws found in reports.

The problem is that I really want to secure the datas stored, meaning that I want my datas to be read-able only by the user and the server (Because it's exposed using a RESTful API, to server an angularjs application).

Data is stored in a graphdb called neo4j

Already thought

• Storing an encryption key in each user node

  • Problem is that if someone steals my database, they just have to find the algorithm used to encrypt and they can get every flaw of every website.

• Encrypt data sent by user with it's password (clear) on client side, so the server doesn't know the key since he is only storing the hashed password.

  • Problem is that the server will not be able to store encrypted data if he doesn't know the encryption key.

How can I achieve that? I really need to secure my data at this point, meaning that even if you steal the database, it's impossible to get data out of it, unless you are... me or the developper who created the encryption system.

Answer 1

One of the main cryptography principle is Kerckhoffs's principle: "A cryptosystem should be secure even if everything about the system, except the key, is public knowledge".

So the option with special key for every user sounds reasonable. Selected algorithm and key length should be strong enough to protect data in case when database is stolen. Recommendations for selecting algorithm and key length can be found in OWASP guide https://www.owasp.org/index.php/Guide_to_Cryptography

The main issue in that case would be how to protect user keys from stealing and implement appropriate key management. The following items should be taken into account during implementation process:

• Key storage: file or HSM (like SafeNet)
• Frequency of key rotation (e.g. change keys once a year)
• Master key (a key from storage with other keys) protection