I want to encrypt sensitive data on my app server (facebook app) in such a way that my app may only decrypt this data when the user is in an active session. I need to be able to reliably derive/regenerate/salt a key to encrypt/decrypt this data, and I would like to use something that facebook will only send to my app when that user is actively logged in, will always be the same between sessions for that specific user, and is not easily forged from information available to other users or apps. Is there any such piece of secret information in either the OAuth 2.0 or the Facebook Connect API that is both user & app specific and will be consistent between sessions?
The purpose for this is to retain a private key of a key-pair that I generate for each user... thus allowing users to exchange bits of sensitive data between one another (or rather, for my app to exchange bits of sensitive data internally) in such a way that this information is secure even if data on the app's server becomes compromised... (I do understand that if the app's server remains compromised for a period of time, that this sensitive information may still be gathered from all users that have had active sessions while the server was compromised. But, I would like to minimize the amount of damage possible in the event that the server becomes compromised... such that any data extracted from the server is useless without each individual user's secret information/key)