I am trying to write a web application with chat system which stores chat messages in a mongoDB database on server side.
I generate a private and public key on server side and encrypt the messages using the private key and store them in my mongoDB database. As much as I have figured, you give public key to everyone but you should not share private key yet messages can be decrypted only using private key as this article suggests.
yet obviously client must be able to decrypt the encrypted message so it can show it to user.
Now we are in a situation where:
- the user must have the private key to decrypt the information.
- the private key should not be passed around as comments on this post suggest
How should one deal with this contradiction?