For a new application I'd like to store messages for each user's account on a centralized server.
- Should be unreadable by the server
- Are readable only by the user themselves (not other users)
- Can be added by the server (readable only transiently before encrypting)
- Can be added by the user (then encrypted and sent to the server)
I'm using libsodium and my proposed solution is to:
- Generate a randomly generated salt client-side using
- Derive a key from their plain-text login password, on account creation, using
crypto_pwhashand the previously generated salt
- Use this key as a seed to generate a public and secret keypair using
- Store the public key and salt on the server (sent via secure transport)
- Store the secret key on the client in localStorage (I'd like to avoid the user having to enter their password too often)
- Regenerate the secret key on login by retrieving the salt from the server and recreating the seed to generate the keypair
- Client encrypts with the public key using
- Server encrypts with the stored public key using
- Client decrypts with the public key and secret key using
Is this scheme vulnerable?
I'm worried about storing the secret key in localStorage.
Does it instead make sense to:
- Store the seed in localStorage
- Generate another salt that is then retrieved from the server
- Hash that together with the original seed to generate a new seed
- Use the new seed to generate the keypair?