I've developed a web application (developed in .NET MVC 4) which have multiple users with personal login credentials. The web application holds a lot of content uploaded by the users.
My client would also like to have an offline version of the application, for Windows. This application should use the same information available on the web, it should be available offline, and it should be secured in a way that a user should not be able to take the application content and give it/sell it to a competitor (in an easy way).
So I have in my web application implemented functionality to create an application package, containing all relevant information, which is downloadable and encrypted with a symmetric key. However, each user should be able to decrypt the package with his/hers credentials (i.e. personal passwords).
So when a user is created I create an asymmetric key pair for that user, and the private key is stored in the database as a encrypted string where the key is the private password (stored as a hash from bcrypt).
This list of events means that there's a whole lot of nested encryption and it makes me feel uncomfortable because I don't really know if it's secure enough - so I would like some inputs on my method of choice.
The chain of functionality;
When creating a user;
- Create an asymmetric key pair
- Encrypt the private key with the users credential password
- Hash the password with bcrypt
- Store hash + encrypted private key for the user
When creating an application package;
- Create a symmetric key [Server side]
- Create an application package (raw data) and encrypt it with the symmetric key [Server side]
- For each user, encrypt the symmetric key with the users public key and store the result so it can be downloaded [Server side]
- A user logs on to download the package+encrypted symmetric key+encrypted private key [Server side]
- Decrypt the stored, encrypted, private key with the users credential password [Client side]
- Decrypt the stored, encrypted, symmetric key with the now decrypted private key for the user [Client side]
- Decrypt the application package (in memory on the clients computer) and show the content via a small, built in, server [Client side]
Is this a fairly secure way to solve my problem? Can I do it in any other way? Is there any obvious security holes in this solution?