Here is context:
I am using
PGP to encrypt messages in a chat web app. After going through some articles, I get brief idea how PGP works and here is how I am doing it with openPGPJs :
Client(web browser) generate the
public/private key-pairsand send public key to server to store it.
- Sender use receiver's
public keyto encrypt data and send it.
- Receiver use their own
private keyto decrypt the message.
As a chat app I need to store all messages and decrypt them when user wants to see old message. decryption of messages need the private key. here the client is web browser which neither can store the private keys for long nor can keep them safe. so I decided to store the private key on web server. Now client(web browser) asks server for the private key whenever decryption of message needed.
Considering PGP an End to End protocol, storing private key on server is vulnerable. my question is:
How PGP encryption works for web based applications where client is not able to keep
private keysafe and confidential?
Is it Okay to store
private keyon server?
- Is there any better way to do this?
Thanks for any suggestions.