0

I need to make the Messenger in the web page secure. For that I use encryption with AES.

So, when one person writes another, the message is encrypted, sent to the server, saved in the DB, and then showed in the messenger of another person. So problem is, the server knows how to decrypt the message- it generates and stores all the keys (as a trusted side), therefore anyone, who cracks the server, may also read all messages.

The RSA and Diffie-Hellman is not useful, because people would not remember and input each time 1024 key. If they will not remember themselves, and the keys will be stored in the DB- it would have no sense.

May someone suggest any other tricky method?

6
  • Asymmetric encryption is actually useful in this case. Have a look at Apple/Whatsapp/Telegram's end-to-end encryption protocol. But I highly recommend you study the basics of encryption and information security before coming up with your own scheme.
    – billc.cn
    Aug 17, 2016 at 14:36
  • The end-to-end decryption is safe only in the case if people generate and store the keys themselves. In case of Whatsapp the application may decrypt the messages itself- therefore the developers may decrypt also. Do you catch what I want to say? Aug 17, 2016 at 14:43
  • The user has to trust something. If the client cannot be trusted to generate and secure the private keys, what can the user trust? Can the user be relied upon to generate cryptographically sound random numbers? Can the user be educated to do public key cryptography by hand? If they have to use software to do these, why is that software distrubution more trust-worthy than the client?
    – billc.cn
    Aug 17, 2016 at 16:26
  • Probably, the best way to ask user to remember/store the key himself. And ask for the key each session for encryption/decryption. Aug 17, 2016 at 17:37
  • for nadachat.com, i generate a new AES key each session, and use ECC to send that key to the joining client: the server or client never stores any keys to disk, making key recovery very difficult. The downsides to this strategy are longer connecting times and lack of authentication from using pre-agreed keys/secrets.
    – dandavis
    Aug 17, 2016 at 20:29

1 Answer 1

0

I suppose, the best way would be to ask the user to remember/store the key himself. And ask the key each session for encryption/decryption. Therefore there is no trusted server, which may be attacked. The keys may be synchronized using the Diffie- Hellman

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .