I'm building an application, part of which will allow businesses to store secrets.
I'm looking at using CryptoJS (https://www.npmjs.com/package/crypto-js). This would encrypt everything on the client side, and send it to the server-side using HTTPS before it is saved to our database. No plain text secrets would ever be received by our server or stored in our database.
From CryptoJS's documentation:
var CryptoJS = require("crypto-js"); // Encrypt var ciphertext = CryptoJS.AES.encrypt('my message', 'secret key 123').toString(); // Decrypt var bytes = CryptoJS.AES.decrypt(ciphertext, 'secret key 123'); var originalText = bytes.toString(CryptoJS.enc.Utf8); console.log(originalText); // 'my message'
We would prompt the user to provide a decryption key (in the example above 'secret key 123'), which we'd put some requirements on such as minimum character length, including a number, special character etc.
From a security perspective, do you see anything wrong with this setup, considering the use-case?
Some previous people have suggested looking into HashiCorp's Vault, which I've already done and got it working as a proof of concept, but the price is too high for this use-case (estimated the cost to be ~$150 per company, per month on their standard plan for a Managed HashiCorp Cloud Vault, and we don't want to self-host our own vault server).