I want to create a secure messaging application such that you don't have to trust the server.
- Register with username and password. ->
- Generate a pair of PGP keys (RSA). ->
- Encrypt the private key with the password. ->
- Hash the password
This is what the server knows:
- AES/CBC(SHA256(pass), privKey)
I double hash the password so that the server can't use it to decrypt the privKey.
This works: after the login the user receives his private key and unread messages, he can query the server for somebody's public key and send them a message.
However, the server could generate a PGP pair and send his public key to Bob instead of Alice's when Bob wants to send a message to her. Decrypt the message and then encrypt it with Alice's actual public key and then send it to her.
How can I prevent this?