I have seen latest mobile authentication solution where private key is generated and kept securely in a Secure Enclave/TrustZone and public key is sent to authentication server on a cloud. During User authentication, the private key is used to sign a message which can only be verified by the paired public key held by the authentication server.

Based on above concept, is it a good idea to generate cryptographic keys for each user and save private key in a secure private network somewhere in a directory or database ? and use that to verify the identity of a user on an authentication server which is on cloud?

Additional context: User details are in a private network and auth server is on cloud.

  • 2
    You are going to need to explain your design a lot more than you have. Who generates the keys? How does the user interact with the keys to authenticate? Is the auth server allowing access to something in the private network? – schroeder Jun 13 at 19:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.