I want to implement a server side application with REST API - clients are browser and mobile app. User will have a login (email, password) and will store his files on the server. These files must be encrypted so that admins or anyone with access to the DB or filesystem wont have any possibility to open these files. Here are my questions regarding this issue:
What is the best way to store encrypted data on the server with using RSA - where as only authorized frontend user would have access to it? Third party should not have access to data, even if FTP access is given. In this case, private key can be "closed" by a user password. User password is only entered on authorization and is not available later on.
My ideas on this topic:
- Storing the private key (encrypted by server) without password in the user session. But in this case, if one has access to server, files can be de/encrypted.
- Storing the private key (encrypted by server) without password on the client's side (in webbrowser) and passing it on request to the server when an encryption process is needed. Here again, a third party with access to the server could intercept the transfer of the key and then encrypt user's files.
- Storing of private key without password on clients side and decrypting files on client's side. This may work with mobile Apps, but not on browser.