Currently, I'm trying to create a web-only end to end encrypted chat, with message persistency.
I did some readup on how to create an end to end encrypted chat in JS, I found out there are quite some libs for encryption in js, which is good to know. I'd be capable of writing a chat straightaway now.
However, I still have some problems thinking about the persistency point of view - How would that work? Let's say, my server stores the encrypted messages, and the client would ask for them when loading the chat, so he can see a chat history.
Most of the tutorials I saw didn't bother with persistence, they just created keys on the fly for each load.
My main problem right now is, that I'd somehow have to persist the chat key for the customer, but I don't know how.
If it is cookie-based, it would probably be lost at some point and with that all messages are lost. Also, this wouldn't work with logins on multiple devices
The only solution I can think of is to store the keys on the database and hand them out to the customer when necessary, but how do I do this without getting knowledge about the keys? As soon as I as a website maintainer have all the info about the customer's keys, it's not really end to end encrypted anymore, right? However, this is the only way I could think of it right now. For this, I would probably have to generate a key-set on signup, which I will then hand out to the customer on login. This key-set will be stored on the database in an encrypted way (My app does have general-purpose encryption for settings etc).
Is this simply a tradeoff I have to do, picking between true end to end encryption and portability between other devices?