3

I need to generate a keypair for each user registered with my website. The user already has an assigned username and password (let's assume that these credentials were assigned to the user and that he did not have to sign up to the website).

Upon first authentication i want to generate a keypair for the user such that he produces a keypair (maybe using SubtleCrypto), retains the private key and send the public key to the website server. I have these questions:

  1. Where do I store user's private key ?
  2. How do I ensure that the public key received by the server is actually from the user that claims to send it and there has been no man in the middle attack ?
1
  • 1
    Good question. I feel like the answers are going to be a little un-satisfying; 1) in local storage, and 2) you can't really; this is a bit of a trust-on-first-use situation, with the first use being only as strong as your username / password mechanism. Though someone more expert than me should give an answer. Commented Apr 12, 2020 at 20:23

1 Answer 1

1

how to associate a public key with a user of a website

To map an entity (a user in your case) to a public key, you can use a digital certificate. For example an X.509 certificate. The user details should typically reside in the Subject part of the certificate, while the public key resides in the Subject Public Key Info part.

Otherwise, you can simply store the public key in the database and link with a user id.

Where to store a user's private key?

With the user. They can store it anywhere on their computer. However the private key should be protected with strictest file permissions (that is how ssh keys are stored typically). Other alternatives include a keystore (see Java KeyStore), or even a password manager (e.g. 1password), or a hardware security module depending on how precious the private key is.

How do I ensure that the public key received by the server is actually from the user that claims to send it and there has been no man in the middle attack ?

To prevent man in the middle attack, you should be using TLS. To make sure that the public key is actually from the user who claims it, the server must make sure that the user is authenticated before accepting the public key.

3
  • You don't need to use an X.509 certificate if the web server has can do a pubkey-to-username lookup in its database. For example FIDO2 keys (ex.: Yubikey) are based on public keys, and there are no certificates involved. Also, since the question is about WebCryptAPI / SubtleCrypto, I assume this is entirely in-browser javascript. Can you expand on how to call into a jks file, or 3rd party password manager from javascript? Is that even possible? Commented Apr 12, 2020 at 20:26
  • True, you don't specifically need a certificate (updated the answer, thanks).
    – bhorkarg
    Commented Apr 12, 2020 at 20:32
  • I was assuming that the user downloads the private key and thereby they are free to store it outside of the browser (perhaps manually).
    – bhorkarg
    Commented Apr 12, 2020 at 20:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .