I am creating a messaging service for an app I'm developing and right now the data flow is as follows:
message sent to server => message encrypted based on user's public key and signed using secret key => encrypted message saved to database
server receives message from database => server verifies signature using public key and decrypts message using secret key => decrypted message sent to client
All the encryption/decryption on the server is dependent upon the user's JWT token being authenticated.
I have two main questions:
Is it okay to encrypt on the server since the communication between it and the client is using TLS?
Should the keys be stored on the server or in the database?