0
$\begingroup$

I want to clarify right off that bat that I am using the SSL/TLS protocol on top of this, so I am NOT trying to implement my own protocol to send data securely. I simply want the server to be unable to read user data.

I'm trying to implement a web application that stores sensitive data. I was thinking about using some public key derivation function to generate two keys from a master password, the first key is sent to the server for verification, and the second key is kept in the browser, and is used for symmetric encryption/decryption, like AES.

The server sends the encrypted information, and JavaScript is used to decrypt that data with the second key.

I've read a lot of sources saying that clientside encryption, especially in-browser with JavaScript is very insecure, but I fail to see what insecurities this method could possibly have.

I really want to cover all my bases, so I just wanted to know if this method is still secure, and if it isn't, what I should do instead.

Improve this question
$\endgroup$

1 Answer 1

Reset to default
2
$\begingroup$

Client-side encryption can prevent a passive eavesdropper on the server's memory—like Heartbleed—from seeing the client's secrets. But, if you might be concerned about any more serious compromise of the server, who delivers to the client the JavaScript code that performs encryption?

Improve this answer
$\endgroup$
2
  • $\begingroup$ Thanks for the answer, but I was wondering if my method introduces any extra vulnerabilities, since I do have my reasons for encrypting user data, for example so that I wouldn't ever see any of it, or if someone was to steal content from the database, he would only be able to gain access to accounts where people have entered their master password into a compromised form. $\endgroup$
    – Nathan Yan
    Feb 11, 2018 at 17:25
  • $\begingroup$ Here are three things you might do. 1. Nothing. 2. Server-side encryption. 3. Client-side encryption. (1) succumbs to passive eavesdropper on server memory or active compromise of server or leak of database. (2) succumbs to passive eavesdropper or active compromise. (3) succumbs to active compromise. So, do they provide qualitatively different security properties? Yes. But the question in your title implies the server is (at some point) malicious; against that threat model, you need some way to pin the client software to before the server was compromised. $\endgroup$
    – Squeamish Ossifrage
    Feb 11, 2018 at 17:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.