Let me start by stating that this is really my first foray into encryption.
I have written username/password systems, and such, and am familiar with salting and hashing passwords... but I have never really done anything with encryption.
I have an idea for a system that I want to build... and I have (what I believe to be) a clever solution for storing the user's data without knowing anything about them... but I am not sure if I am opening the door to some kind of "promise not to peek" flaw.
My idea is this: I want to be able to store encrypted information without knowing anything about the user.
Is there a flaw here? Am I overlooking something?
I want to be able to respond, even to a government subpoena, with "I don't know. And I can't find out."
Of course, malware on the client-end would be a problem... but I haven't been able to think of any way around that... and that isn't the issue I am trying to address right now. I just want to figure out a way to store customer information without know anything, at all, about my customers.