I want to create Password Manager where users can create their accounts and store website passwords.
For the frontend, it will be a mobile app, but I need REST API as the backend data where the data will be stored.
I thought to encrypt and decrypt the data with AES, but then I need to exchange secret key in a secure why and that could be a risk.
Currently, I am investigating using Public/Private key algorithms like Ecliptic Curve that can easily exchange public keys, and sign and verify the data.
So, here are my questions:
- What would be the recommended way to do this to exchange encrypted data between frontend and backend?
- Where to store the private key on the backend? I am thinking about using Spring. Should I use KeyStore?
- For users authentication and authentification should I use OAuth2 or do it manually or some other way?
- Do you have any other advice or suggestion?