I'll try to be as brief as straight to the point as possible, i'm new to this so please bare with me! I might be committing a massive mistake and not even realised! Please HELP! [facepalm emoji]
- The frontend must be a website
- User must provide his own API TOKEN and SECRET to a 3rd part API
- While logged in on the website the user can manually trigger actions on such 3rd API through my application UI
- While the user is logged out my service must do scheduled calls to the 3rd part service ( read as: one server must be able to read and send his keys via POST to a 3rd part service in plaintext )
Here are the steps i'm taking in order to decrease my surface attack:
Deploy a micro-service that will be responsible only for storing keys and doing background jobs
Generate an RSA key for my micro-service
Hide the micro-service from the user by only having the url on the backend side ( use my http server as proxy )
When the user manually execute an action through my UI:
I'll generate an RSA Key on the client side using his password ( must be strong ) as passphrase and generate a 1024 bit Key, send the public key to the HTTP Server which will send it to the SECRETS SERVER
On the secret server if the user was never registered i'll save this user_id and associated public key
When the user input his keys, i'll encrypt the keys with the PUB KEY of my SECRETS SERVER and sign with user's private key
Post it to my HTTP SERVER which will post to my SECRETS SERVER
My secret server checks if the message was signed by the pub_key he excepts and if it is, save the user data encrypted with it's own ( server ) private keys on the database
When a background job must be executed:
- The SECRETS SERVER read the key from the database, decrypt the API KEYS, does the HTTP POST and remove the plaintext from memory
What could go wrong? ( as far as i understand! )
Someone gets access to my HTTP server, discovers my SECRET SERVER, crack into it, read the database credentials and the private key, get the API KEYS and run away.
Someone get access to my credentials, finds the secret server computer, manages to download the database, find the private key, get the API KEYS and run away.
What else could go wrong?
Generating an RSA key on the client side using user's password as passphrase is "good enough" ?
Will the RSA key generated on the client be constantly identical regardless of the computer they log in?
Does this even make sense?
On this thread if i understood correctly it's recommended to "stretch" the passphrase before generating the key, but since a user could reverse engineer the .js file on my website they would also discover how the key are stretched, right?
Thank you for reading it all through! I really appreciate any advice.