Currently I am working on an application that requires secret keys to encrypt and sign information generated by the client and transmited over the wire, these keys are granted per user.

Currently when the user logs in, the keys are downloaded from the API and persisted on localStorage, which is far from optimal as other plugins or embedded applications could obtain them (if they know how these are stored).

I've been trying to implement an isolation mechanism using iframe whereby the client application sends messages to an embedded external site that controls the access to the keys. This moves the issue to the localStorage created by this external website, avoiding an embedded site on the client application to get the information.

I am still hesitating about this approach, mainly because there's still storage involved.

Could anyone share relevant experience or suggest a different approach?

  • You may want to consider storing the private keys in a Web Cryptography API CryptoKey object, with the .extractable property set to false. This way the private key can only be used for decrypting and/or signing messages within the browser - but can not be read (even by client-side scripting in the browser). See crypto.stackexchange.com/questions/35530/… for more info.
    – mti2935
    Commented Mar 4, 2023 at 19:29
  • what do these keys add that TLS does not provide?
    – Jasen
    Commented Mar 5, 2023 at 7:47
  • @Jasen these keys are to a)store data that only the user can access or b) exchange data with other users asynchronously
    – Ray
    Commented Mar 5, 2023 at 15:36
  • Why can't these be stored in a database?
    – Chris K
    Commented Mar 23, 2023 at 21:55


You must log in to answer this question.