I'm creating a mobile app which has chat feature in it. Since I wanted to make it secure, I'll do some encryption to messages and the data. I'm thinking of using End-To-End encryption for it but I've got some issues.
Each user will have private and public keys to encrypt and decrypt the data (asymmetric key encryption) and I figured out how to exchange this keys between. So End-To-End encrypted messaging is done.
Here are my issues:
If user changes the device or reinstalls the app, the private key which stored on client will be lost. I know I can create new key pairs for future messages but how can I restore the old ones?
I thought storing the private key in server but it won't be secure at all. I thought storing the private key after encrypting it with user password, it would be secure since I don't know the user's password, but it fails too if user lost his/her password and re-creates one with a "lost my password email".
And another issue is if some legal issue happens, I can't give the chat logs to police because I don't have the decrypted messages or I don't know how to decrypt them because I don't have the private key.
So, how should I handle this issues? How does WhatsApp do it while using End-To-End encryption? You can restore the old messages in WhatsApp after changing device, updating or re-installing the app etc...
I read something about re-encrypting and re-sending the messages from the other user. (Receiver-Sender) But I don't know how effective it would be tho.
Any help would be great. Thanks for all information and help.