I'm currently designing a mobile/desktop application synchronise some messages or notes. I'm searching a way to secure it and to avoid let the server being able to read the messages.
My goal is have a client which encrypt a message in client side, sending it to the server which stores it to the database. Then, if another client on the same account is connected, it will received the encrypted message, decrypt it and store it in his local cache.
I can't just use one of the standard end to end encrption because I don't want to have a different key each time I use the application. I want to be able to store the messages in the database.
An other constraint is that I don't want the user to manualy manage the keys. I just want a password for the account.
So, a solution I have imagined is to use an asymetric algorythm like RSA and a symetric one like Blowfish or CAST. I generate an RSA ket pair when the user create an account, encrypt it with CAST and the user's password as key and store the result localy on the phone. Then, the messages are encrypted with the public RSA key, sent to server and stored in the database. To be able to decrypt messages on an other client (like on the PC for exemple) I just send the encrypted key pair from the phone to the server that sent it back to the new client. The new client can now decrypt the RSA key pair with the user password and decrypt messages stored in the database.
Since I'm pretty new to all this stuff, I don't if this is a good idea or if there is a better way to do it.