Here's what I would like to do: have a client side that generates and processes the user's data, then encrypts it and stores in a database - in order to later retrieve, decrypt and process the data further.

The server would authorize the user somehow and then let them save and retrieve their data. Ideally, the server should know nothing about the encryption/decryption keys.

Now if the user loses their keys (e.g. local disk crashed), I'd like them to be able to retrieve those keys from some secure place, ideally authorised by the same account as the server database, but not stored at the same server.

How would you approach this scheme and what services exist that would allow me to do this?


I cannot encourage your idea of an online backup of the decryption key. As soon as the decryption key leaves the devices controlled by the data owners (the users) the whole effort of client-side-encryption becomes worthless.

A secure place for a decryption key can only be defined by the data owners since only they know the value of the encrypted data. You could offer a key export functionality, give some useful hints and leave it to the users where they will store the keys.

  • Well, I believe Google offers the users to store their passwords and probably keys and other sensitive stuff. So I see it like somebody uses their Google account to authorize and the same account to store the key. Why not? But how to use Google's service in this way? Or maybe there's some other service of that kind? – podlec Jul 4 '17 at 22:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.