0

I want to create Password Manager where users can create their accounts and store website passwords.

For the frontend, it will be a mobile app, but I need REST API as the backend data where the data will be stored.

I thought to encrypt and decrypt the data with AES, but then I need to exchange secret key in a secure why and that could be a risk.

Currently, I am investigating using Public/Private key algorithms like Ecliptic Curve that can easily exchange public keys, and sign and verify the data.

So, here are my questions:

  1. What would be the recommended way to do this to exchange encrypted data between frontend and backend?
  2. Where to store the private key on the backend? I am thinking about using Spring. Should I use KeyStore?
  3. For users authentication and authentification should I use OAuth2 or do it manually or some other way?
  4. Do you have any other advice or suggestion?
Improve this question
7
  • 1
    There are a large number of password managers that already exist...Why do you want to build another one? Additionally, while I'm always in favor of learning and growth, a password manager may not be the type of application you want to tackle first. – Xander Sep 21 '20 at 12:39
  • @Xander There are some internal business reasons. I have created already some password managers that worked only locally on the device with AES, but in the case when I need to transfer the data that does not look like the best solutions. For some other clients I have used ECDSA for that, but I have not designed the API, it was provided by them. So, in this case I am looking for more information on the API side of the work, not just the frontend. Can you share a few advices on that? – Zookey Sep 21 '20 at 12:56
  • The best option would be to not store the private key at all. It should be derived, in the client side app from a password. Data should only be encrypted and decrypted on the client, not in the backend. When the client sends it to the REST API endpoints, it should already be encrypted with a key the server does not know. When the client requests data, the REST API should send the encrypted blob from the server, to be decrypted only after it reaches the client. – Xander Sep 21 '20 at 20:30
  • Thanks for the answer. So, the private key should be derived from the password and data should be encrypted and decrypted on the client only and send encrypted data on the backend. How to do a search in that case in the backend? What would you recommend in this case? AES or? – Zookey Sep 21 '20 at 20:37
  • I would recommend "don't." If you want it to be reasonably secure, the backend shouldn't know anything about the plain-text data. Search functions should only be implemented in the client application. – Xander Sep 21 '20 at 20:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.