Is there any best practice on how to handle "the last mile" in a cloud stored, client side encrypted scenario for a web application? (Sensitive data has to be encrypted before being sent and stored on the server)

Where are the keys stored and what's the best way to get them as safely as possible into the browser/client application?

I understand that this is an imperfect scenario to begin with, but if these are the constraints, what's the best way to handle it?

Trying to clarify more:
We are running a web application that allows doctors to schedule patient visits. We are now asked to provide the possibility to also store sensitive patient data.
The only way we want to even consider this is with client side encryption, i.e. we never get to see or can access any of that sensitive data.
At the same time it has to be viewable / editable in the web-app on the users computer. User authentication, TLS/SSL etc. is already used and properly implemented.

To decrypt existing data or encrypt new data the user will have to provide a keyfile (let's assume regular asymmetric private key for now although we are not entirely sure about that yet - but that's a different discussion).

The question is now what's the best approach for safely storing this keyfile on the users side and how to enable the webapp during use to decrypt/encrypt the data while minimizing the risk of accidentally leaking a key or someone actively stealing it.

I understand there is no way this is going to be a "secure" scenario given the constraints but we are looking for the "least insecure" way to run CSE in a web-app context.

  • 1
    I think you need to indicate what threats you are worried about. At first glance, an SSL/TLS connection would prevent someone eavesdropping on any keys... are your concerns from 3rd party attackers, or, say, a legitimate user subverting the browser code to submit false data? – TripeHound Oct 9 '18 at 6:45
  • This question is a bit confusing. You're saying on the client you want to encrypt some content, then send it to a server running a web application, and then store it on the server. Is that correct? Are you trying to do the encryption of the content IN the browser before it gets transmitted to the server, or are you encrypting the content before you put it into the browser? These keys you mention, are you referring to keys for symmetric encryption or asymetric encryption? You may want to edit the question and reword/clarify the scenario some more. – Daisetsu Oct 9 '18 at 7:03
  • I added some more info to clarify. – TommyF Oct 9 '18 at 7:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.