Assume we have a malicious storage server (a user-agnostic key-value store, supporting
server.put(key, value) and
server.get(key)) that we want to use for per-user based secure file storage. The two interfaces I want to make secure is
client.upload(username, filename, message) and
client.download(username, filename), which communicate with
server.get() behind the scene.
- Each user has his/her private keys securely stored locally, and public keys stored on a secure public key server.
- The malicious server may try to tamper with the uploaded message.
- The malicious server can make a user upload arbitrary files with any name and content it wants.
- The malicious server will not roll back a file, or delete it.
- Filenames and file contents are non-empty.
- The lengths of the filenames and file contents need not be confidential (e.g., the malicious server will not make the user upload one out of two files with different lengths, and try to guess which file he/she uploaded).
- The filenames and file contents themselves must be confidential.
- The client must reject any files that have been tampered with, or not uploaded by the specified user. (I.e., integrity and authentication.)
The design I'm thinking about is:
- Key (to be used with storage server) =
- Value =
signed(encrypt(message, priv_key_1), priv_key_2)
Is there any flaw in this design?