I'm working on an application that acts as a back end (REST API) for a Google Chrome extension. Data is supposed to be sent from and to the client.
The way it works is:
- The data that comes from the client is encrypted by the application using AES-256 (using the master key, look below) and stored in a SQLite3 database.
- The data that is sent by the application to the client is decrypted in the back end and then sent over an HTTP protocol.
Note, the application and the extension reside in the same local environment, thus other computers on the network can't access it. That's why the data is transferred in plain text in both cases.
There are a few constraints:
- There can be a number of clients sending requests to the back end. They are all controlled by the same person.
- There is a sign in form in the client and it only requires a master key. Once the form is submitted, the key is supposed to be sent to the back end and the client is authenticated, i.e. by comparing it to the one (encrypted using PBKDF2) in the database.
So the question is what would be the optimal solution?