this is a very top-level question - as I'm just starting to delve into crypto.
The main objective is to be able to communicate between 2 mobile devices through a BAAS server such as Firebase so that one app can notify another one and send data.
The data to be exchanged are encrypted image documents. Security is paramount since the images may contain sensitive data.
I will be using Ionic 3 to develop the apps.
So far I have tested the following technologies:
- Using WebCryptoApi in Ionic 3. I tested a few examples from WebCrypto Examples, and they tested ok on android.
- App to App communication (using Notification) using Firebase.
I plan to decode an image into Base64 (which is just a string) and use AES encryption/decryption.I plan to use the following simple workflow:
- Case Scenario: User A requests file from user B:
- User A creates key-pair and sends the public key to user B
- User A keeps app open so that the private key is not stored anywhere.
- User B encrypts the file with the public key
- User B sends encrypted file to user A
- User A decrypts user B's file
But Web Crypto does not seem to generate a simple AES Private/Public Key pair that enables me to encrypt/decrypt, as is the case with RSA-OAEP for example, where I can generate a public/private key pair.
AES-CTR, for example, only generates one key and uses a counter instead of a private key. But this counter is needed to encrypt as well, which makes my scenario not possible.
Is it possible to achieve my scenario with AES? If so, how should this be done? If not, what approach should I take?
I Appreciate any comments on this.