I am building a web app which uses Sign in with Apple for the normal authorization and login.
After signup the user should create a passphrase which is enhanced via a KDF and acts as a synchronous key for encrypting all sensible data. Normal operation should look like this:
- Client encrypts data locally and sends it to the server.
- Encrypted data is stored in the server’s database.
- Client requests encrypted data and decrypts it locally.
The clientside storage of this key should be as secure as possible and never be sent to the server – otherwise I as the owner (or an attacker in the system) could decrypt the users database entries.
My first idea was a cookie – save against cross-site scripting, could be set with an expiry data – but the cookie would be sent with every request… And all I heard about all the other local storage alternatives was that they were not secure.
Of course I have the added layer of security with the Apple authorization, but I still would like to store the key as securely as browserly possible. 🙂
(browserly possible = I want the key to be stored in the browser, protected primarily against remote attacks and automatic expiry would be a nice addon…)
Thank you for your answer!
Hashing of the key is not possible, because I need to retrieve it.
Cookies are not possible, because that would automatically send the key with any request.
Local Storage is not save.
I hope someone comes up with a smart solution that I have not thought of yet and maybe helps me with this issue.