I want to implement a server side application with REST API - clients are browser and mobile app. User will have a login (email, password) and will store his files on the server. These files must be encrypted so that admins or anyone with access to the DB or filesystem wont have any possibility to open these files. Here are my questions regarding this issue:
What is the best way to store encrypted data on the server with using RSA - where as only authorized frontend user would have access to it? Third party should not have access to data, even if FTP access is given. In this case, private key can be "closed" by a user password. User password is only entered on authorization and is not available later on.
My ideas on this topic:
Storing the private key (encrypted by server) without password in the user session. But in this case, if one has access to server, files can be de/encrypted.
Storing the private key (encrypted by server) without password on the client's side (in webbrowser) and passing it on request to the server when an encryption process is needed. Here again, a third party with access to the server could intercept the transfer of the key and then encrypt user's files.
Storing of private key without password on clients side and decrypting files on client's side. This may work with mobile Apps, but not on browser.
This means these actions need to be done either by a fully trusted third party or by renting computing power from a trusted third party or by the user itself on its own (trusted) system. The latter might be achieved with standalone apps (from a trusted source). In the browser this could be done with some extension from a trusted source. It could not be done with extension or HTML+script loaded from the untrusted server since this could have been manipulated by the malicious admin.