I'm creating a secure web app with the purpose to act as a no-knowledge storage for small data (we're talking a few bytes). Since all the encryption and decryption happens client-side, for the user to be able to manage their secrets, the data has to be decrypted to be searchable and so on.
The server knows an encrypted name and an encrypted value.
All of the data is once encrypted by the client, then encrypted once using a shared secret from SRP and then sent through SSL.
Solutions / concerns:
There's two ways this can be done from what I know.
B: Send only the encrypted name and a token. The names are stored and shown to the user in a decrypted form. Whenever the user would like to see the decrypted value, a request is made to the server which sends it. The value is never stored on the client. This limits the risk with offline attacks - since the user will never have all the values stored at once. The worst scenario would be one value stored. The problem I see with this is that there will be a considerate increasing amount of data sent through the internet - which might be a greater risk than storing it offline.
Is it safer to store the data on the user's device without being able to revoke their access to the data
Send valuable data many more times through the internet?