Javascript client side image decryption, does this add any safety or is it flawed

Question

I want to store passport copies safely in a database, the database itself is a normal MySQL database and on a somewhat trusted web server. The user who owns the passport copy should only be able to upload his or her passport not view it. The approach I want to take consists of the following steps.

Configuration:

1. System administrator opens page via https
2. Administrator submits a generated public key to the server and stores private key locally (on smart card or something not permanently attached to computer preferred)

Passport storage:

1. User opens page via https
2. User selects passport copy (image) in browser and submits it to the server
3. The server encrypts the image with the public RSA key and stores it in the database column
4. Server overwrites any unencrypted copy in memory

Passport retrieval:

1. Admin opens page via https
2. Server loads encrypted column and sends the encrypted image via AJAX to the admin browser
3. The admin's browser loads the private key from a file or smarcard and decrypts the image using https://www.pidder.de/pidcrypt library
4. The unencrypted image data is injected into the src attribute of a image tag.

(I have not yet found a good way to load the private key in the browser)

Questions:

• If the server is hacked and the database downloaded by the attacker, are the passport copies then safe?
• Is there a better way to ensure the copies are safe?

Answer 1

it DOES potentially add security in that the private key is not on the web facing server. Since that server is Internet-facing 24x7 it has a VERY large attack potential.

It does assume however that the administrator PC is well secured & this may not be the reality. The use of a removable secure store such as a smart card is potentially better as indicated by you - assuming the store is kept secure ;)

The copy on the web server will be as secure as the method used to encrypt the data. Assuming best practice, that should be pretty good though if an attacker got the whole database and if that contained many thousands of entries all encrypted with the same key, the security would be weakened. Salting and multi-pass encryption would probably help with that.

However, there is an even stronger and potentially simpler way of security the data. It depends on how you are using the image though. You could simply not store the image on the web server! In a typical enterprise setup, you would keep a secure data server inside your network (whereas the web server would be in the DMZ). The secure data server would periodically take the data from the web server and delete the image on the web server. Combined with a sensible encryption process similar to the one outlined but where the private key was kept on the internal network, possibly in a security accelerator card for ultimate security, this would get rid of the need for administrator intervention and would keep the sensitive data out of view.