I want to use multiple clients but I don't want different public key for that specific user. So I have to share the private key between all clients that I only have to use one public key. So I thought if it is secure to encrypt the private key with aes of the first client which generates the key with an password and then send it to the server which stores it in the database. And when a user uses another client the encrypted private key in the database is sent to the new client and can be decrypted with the users password so the client can also receive messages with only one public key. Is this a good way to go? I cannot think of another way to use RSA with multiple clients.

Ps: This is for a secure chat system!


1 Answer 1


If encrypted private key can be requested by an attacker (you didn’t specify any authentication for the request) or your servers are compromised then you’re opening your users to offline attacks. Now the only barrier between attacker and user’s private key is the user’s password.

Generating per-device key pairs is preferable, for example user can deauthorize key pair of a lost device.

If you insist on sharing one key pair I suggest transferring it from client to client within an end to end encrypted channel. This way:

  • the private key transmission is protected by a much more secure keys generated by DH key agreement. Beware of MITM attacks, they could be discovered by comparing hashes of keys between the devices
  • the encrypted key is transmitted only once and never stored, unless the attacker is eavesdropping at the moment of transfer
  • the transfer could be performed directly between the devices through a local network or a cross-nat p2p protocol. This fully excludes your server.
  • You get the encrypted private key at successfull login with your token and your userid. When a device is lost you could just delete the existing keypair. Then you would just need to login on every device once again. Pre device keypairs would be painfull because the user A would need like 5 public keys to encrypt one single message and also would have to send 5 messages to the server. But would be possible yes. Client to client is problematic if you want to login and don't have access to your first device (when it's offline). Dunno if that is so preferable
    – Jannis636
    May 1, 2020 at 14:51
  • @Jannis636 you should look into how signal/whatsapp is constructed, they are pretty secure and open about encryption protocols. Their apps allow to share the user identity between devices via QR code, jt probably contains id and ephemeral encryption key to retrieve encrypted identity from the server. What you’re proposing is similar to Telegram, if I understand their crypto correctly. May 2, 2020 at 9:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .