Our plan is to:
- when the user registers, generate asymmetric keys on the client side and send them to the server, with the private key encrypted with a key derived from the user password
- authenticate the user by asking the encrypted private key from the server and decrypt it on the client side using the user password. Successful decryption equals successful authentication
- generate symmetric keys when a sensitive document is created, encrypt the document and share these keys with the authorized users, PGP style
- for password recovery we give the user his plain private key and trust him to keep it safe
Note that we assume that the attacker doesn't control neither the browser nor a running server.
In this scenario, what attack vectors do you see?
Is it possible to implement a simpler recovery mechanism that doesn't require the user to store the private key?
Do you have any other concerns/recommendations?