15
$\begingroup$

I am working on a web application enabling users to communicate over private messages which is just one part of the whole system. The main focus during my development process is to protect the privacy of my users, I think this should be one of the main responsibilities for every software developer. Especially when you think about the harmful data leaks over the last years.

I've read a lot of articles about end-to-end encryption and that famous messaging apps like Whatsapp use end-to-end encryption to protect their users privacy. I want to achieve that my server and my application have zero knowledge about the contents of messages being transmitted.

When you have applications which are installed on the users device I know theoretically how to store and protect the private keys on the users device. But in my special case, there is going to be no executable installed on the users device. They are accessing the web application over their browsers and a secured https connection. This fact causes me quite a headache. I can't even imagine how to store the private key permanent and secure in this client side environment. So I thought about storing the keys in a secure way on the server, but this is a contradiction to my mind, when thinking about that I have to assume that a potential adversary takes over the control of my server, database, ... the whole machine while everything is running and the "key vault unsealed".

I opened a question on StackOverflow a couple of days before if you want to read more about my way to desperation. Protecting application secrets like encryption keys and other sensitive data. After a long discussion I was referred to this Cryptography Forum of StackExchange.

So I want to ask you without focusing on any special programming language: "Where and how to store private keys in web applications for private messaging with web browsers?". Thanks in advance!

$\endgroup$
  • 1
    $\begingroup$ If you're bound to the browser, there's not really any good and understandable solution for the user. You could use client certificates but I doubt you can use them to encrypt / decrypt stuff outside of the TLS handshake (also the UI for client certificates kinda sucks). The best option you possible have (in terms of security) would be a browser extension (but this would bring other problems). The problem is also how do you get the encryption code to the user? JS? Then you can just keep the keys as well, as you could in Theory just dump the users secret with malicious JS. $\endgroup$ – SEJPM May 23 '16 at 19:22
  • $\begingroup$ BTW: Welcome to Cryptography.SE :) And maybe have a look at a somewhat related project: Mailvelope (PGP in the browser with similar problems). And of course: +1 for actually asking "I have a browser and want to do E2E, but how could I?" which looks like it has a large re-usability for other people. And may I also ask: Is this supposed to be real-time only or also "asyn" communication? $\endgroup$ – SEJPM May 23 '16 at 19:23
  • $\begingroup$ @SEJPM thank you for welcoming me :) I am getting crazy on thinking about how to solve this problem without creating more system requirements than a browser and https support. I thought about using browser extensions as well but this would not be an acceptable solution for most of my users. Client side JavaScript code must be certified to be not altered as you already mentioned , it is so annoying that achieving good security with standard tools like browsers to protect users privacy is that hard, there should already exist solutions [..] Maybe there is something I have overseen ... ? $\endgroup$ – John Doe May 23 '16 at 19:58
  • 2
    $\begingroup$ I think the problem you have to solve before even thinking about encryption is ensuring the code that encrypts is delivered safely. This means that you have to use server-provided code (as you want to minimize user-burden), you have to enforce code validation, you have to ensure the code can't get secrets if your server gets breached and you have to ensure the code can't be tampered. $\endgroup$ – SEJPM May 23 '16 at 21:08
  • 2
    $\begingroup$ the safest way to store keys is not to store them at all; use a different key per message derived from a different key per conversation for maximum privacy. $\endgroup$ – dandavis May 25 '16 at 2:52
10
$\begingroup$

You may want to consider using the Web Cryptography API for client-side cryptography in the web browser. Then, you can create a keypair using the webcrypto api, and store the CryptoKey object, containing the user's private key, with the .extractable property set to false, using Indexed DB storage. This way the private key can only be used for decrypting and/or signing messages within the browser - but can not be read (even by client-side scripting in the browser).

For more info, see:

https://pomcor.com/2017/06/02/keys-in-browser/
https://www.w3.org/TR/WebCryptoAPI/
https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API
https://www.w3.org/TR/IndexedDB/
https://www.boxcryptor.com/en/blog/post/building-an-app-with-webcrypto-in-2016/
https://gist.github.com/saulshanabrook/b74984677bccd08b028b30d9968623f5
https://blog.engelke.com/2014/09/19/saving-cryptographic-keys-in-the-browser/
$\endgroup$
2
$\begingroup$

Reffering to the question provided by me: "Where and how to store private keys in web applications for private messaging with web browsers?" which means that I want to find a bullet proof mechanism to permanently store and protect public keys in web-browser for end-to-end encrypted messaging without needing more than:

  • web-browser
  • HTTPS support
  • javascript
  • permanent storage within the browser

I had to sadly accept, that there is no answer (which is perfectly secure) to my question.

I want to justify this statement by providing a summary of the comments section discussion and refer to some external sources to undergird the weak points within the destination environment.

  1. Storing Private Key in a Cookie - This approach is very straight forward, but also involves some security issues. First of all a cookie is sent within each http request if the "URL requested is within the same domain and path defined in the cookie" - Stackoverflow which means that the private key is transmitted to the server with each http request of the user owning the private key. The client-server communication is protected through HTTPS but if the server is compromised then the private key is leaked. The next problem associated with storing secrets in cookies is that if the cookie expires or is removed through browser settings or by the user himself, then the private key gets lost forever.

What about storing an encrypted private key in the cookie and a backup of this encrypted private key on a secured client-side data storage device?

Well, that is an option. Let's assume that the user could encrypt the private key with AES and a strong password remembered within the users mind. Then even if the cookie is transmitted over a secured line to the server with a compromised application running, than the adversary could not accomplish anything with the encrypted key. And if the cookie expires or is removed from the browser the user could restore it through his external backup. At this point of writing we could think we have resolved the problem. I'll show you that we unfortunately have not, but before I will provide you a vivid example, I have found on a website during my research (but unfortunately I've lost the URI), why transfering the private key even if encrypted and over a secure line is not rational at all. Imagine you have made some very private pictures of yourself, you have encrypted these pictures with a strong password and a secure crypto mechanism, anybody could decrypt these pictures within the next millions and millions of years, but you would not send these encrypted files to your friends, because you'll feel uncomfort about the risk of decrypting your pictures by one of your friends. You should also feel uncomfort about transfering these encrypted private keys to a server.

  1. Client-side javascript encryption - at the time of writing this answer there are different javascript encryption libraries, one of the most advanced is the "Stanford Javascript Crypto Library (SJCL)" which can be used to encrypt data like, in our case, the private key. The problem about client side encryption with javascript is that an adversary could inject malicious javascript code through compromised servers or cross-side-scripting attacks. You cannot sign your javascript files (at least not with the questions system requirements) and you cannot verify the entire document to be trustworthy. So an adversary could steal users private keys before they are encrypted or when they are decrypted through the users password. For further explanation I would reffer to the URI provided by @ArtjomB. Javascript Cryptography Considered Harmful

At this point I have provided enough serious security problems, that any further discussions about the question with the requirements listed above is senseless. But for completeness I will have a look at further solving approaches discussed in the comments.

  1. Browser plugins - Browser plugins do not match the system requirements listed above. For further explanation about browser plugins have a look at (Javascript Cryptography Considered Harmful)

  2. Web Storage API - Better solution than storing in cookies because offline content without transfering values with each http request, but still vulnerable through malicious javascript and xss.

Conclusion: With the system requirements listed above there is no secure way to accomplish what I asked for. JavaScript is no suitable language for client-side encryption (see Javascript Cryptography Considered Harmful) and Browsers are not designed for this purposes at the time of this writing.

$\endgroup$
  • 5
    $\begingroup$ article is way out of date. you can use tls, window.crypto, and the newer browser features like csp and subresource integrity to verify scripts. you can also use an IIFE to gen the keys and define an interface not available to later-added scripts, or use a sealed Worker to prevent arbitrary code from altering the sjcl code. lastly, if you use a user-prompted password (+b/scrypt) to feed aes, you can store the ct in localStorage w/o worry. $\endgroup$ – dandavis May 26 '16 at 21:08
  • $\begingroup$ i added a few links to the comment, and can zoom-in on any problems areas, but there's a lot to cover. unless you show other users content from other users, XSS is impossible. to protect chat messages, use a sanitize function and https, and 90% of the attack vectors go away. then, add a CSP HTTP header to the page, and integrity attribs to any off-site <script> tags to stop the really cleaver attacks. ask me for specific details if needed. lastly, i agreed with JCCH back in the day, it's just been outmoded since written... $\endgroup$ – dandavis May 26 '16 at 21:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.