Centralized storing of private RSA key

Question

I working on multiuser project, where users can share data. The data that users upload to the server will be encrypted before it leaves the client with a symmetric cipher, and then the symmentric key is encrypted with a public RSA algorithm to those who the data is ment for (Basic PGP). In this way I can guarantee that unauthorised users don't get access to the data, even if they are able to gain root access to the server.

The question is how should I handle the private RSA keys. By using public-key cryptography the user is very much «locked» to that one devices that contains the private key. But let assume that user wants to switch between smartphone, laptop and desktop. Is it secure to encrypt the private key with symmetric cipher and use PBKDF2 to iterate the password before I upload the private key to a centralized server?

Or is there a better way to share private keys between multiple devices?

Answer 1

Technically, yes, it can be secure.

However you are worried about a server compromise. And the consequence of such a compromise would be that the user's private keys can get subject to attack by brute-force and / or dictionary attacks which usually doesn't end well because users tends to pick bad passwords. While you can make this harder using Argon2d (don't use PBKDF2) it's still not impossible for an attacker to even recover a moderately difficult password.

You see the problem now. Because of this I'd suggest leaving the user the choice to sync their encrypted private key to your cloud, to their own cloud service provider, to one of their other devices or don't sync it at all and give them a short explanation.

This will synchronize your private decryption key to our cloud. If you lose this key you will no longer be able to access your encrypted messages. By synchronizing we can also ensure you can use this key from your phone and your laptop. However note that if we get compromised there's a risk that an attacker can recover your password and the key if you're not 100% confident in it. If you don't synchronize there's no risk of a server compromise leaking information about your messages or key.