I understand that messages are encrypted using a symmetric algorithm such as AES, and the symmetric key is encrypted using an asymmetric algorithm such as RSA. In my particular implementation, the private key is encrypted using a key derived from a password.

Because this is a zero knowledge system, all encryption should take place client side. But I don't want people to be able to circumvent the javascript and directly POST cleartext. How should the server make sure that the message has been encrypted properly?

  • $\begingroup$ Zero knowledge is a well-known definition that requires a simulator algorithm. Client-side encryption, javascript and POST are not required by this definition. What exactly "properly" means in your case? $\endgroup$ – Vadym Fedyukovych Mar 9 '17 at 22:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.