I want to make a mobile app that will act as a Credentials Manager and store all my access information for websites, credit cards, secure notes, and so on on the server encrypted with REST API.
The plan is the following for the client:
- The mobile app will be the client.
- AES/CBC/PKCS7Padding encryption, master password used for authentication.
- SecretKey would be stored in Java Keystore, since it is an Android app.
- The data would be sent encrypted to the API.
The API would work like this:
- It will store all data that it gets from the client, encrypted.
- HTTPS communication.
I would like to get some feedback on this approach or propose some other solutions.