Let's say, we develop a social network website, which allows to send personal messages between users. We don't want anyone (even us) to read these messages, except for message sender and receiver.
Is it possible?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
What you are looking for is something called public key encryption.
The analogy is that we have two people: Alice and Bob. Alice wants to send a message to Bob but they haven't met before in private, so they don't have any pre-established secrets/keys/etc.
Alice sends Bob a message saying "I want to send you a message. Please send me an open lock that you have the key to". This 'lock' is called a public key in the crypto world.
Bob sends Alice a copy of the open lock (since stuff can be easily duplicated in the crypto world). Alice puts her message in a box and locks the box with Bob's lock. Alice then sends the locked box to Bob.
Bob receives the box in the mail and uses his key (with only Bob has access to) to unlock the box. Bob can now take out the message and read it. In the crypto world, this private key is called, surprise surprise, the private key :)
The process of locking the message in a box so that others cannot read it is known as encryption
The #1 rule in crypto is don't write your own crypto. That's because it's super easy to mess up, but that doesn't mean you shouldn't use an established crypto implemetation.
So what you probably want is public private keys.
User A sends his own public key to User B, User B can then encrypt messages using Users A's public key.
User B then sends back the encrypted message to User A, user A has a private key which matches the public key, user A must always keep this PRIVATE. Using the private key user A can decrypt the message from User B. Once Encrypted user B would not be able to decrypt the message, the public key is used for encryption only.
what you are looking for has been used in many technologies, I use a similar method day to day with PGP.
obviously you would design your application to take this into account to handle all of the key generation and store them on the persons device (never store them on your server)
Another method would be to user a preshared key and another type of encryption like AES, this however would require the sender and receiver to know the same key. problematic if you only talk online.
preshared key would mean the user would need a key for every conversation, while a PPK (public and private) would mean that many people could have a users public key and the user hold securely on to that private key.