I have a specific use case I am interested in. I have spent the better part of the night reading research papers. I am beginning to believe what I want is not possible so I wanted to confirm here.
Scenario: I have customers with a private key. However, this private key is on the device they installed my software on. They have no clue what or why they have a private key and could care less. This is important for using the software. They can also use the software on their phone, not just their desktop. I need a way to get that private key on both devices without them communicating with each other but only through me. I however, do not want to be in contact with the raw private key.
I am happy to store an encrypted version of this key but I don’t want the ability to decrypt it.
I am also aware of the fact that I can use a password. So device A can have the user enter a password which can be used to encrypt the key and then they can send it to me to store. Then on device B I can send them the encrypted key and they can use the password to decrypt it. This is trivial.
The key requirement I am trying to get to is I don't want a user to have to enter a password on each device to be able to decrypt the key. The only passwordless solution I found in my research requires the devices to communicate to agree on a key. This would mean both devices have to be online at the same time. So the only real world way to do this is to have a user perform an action on device A ( if not online ) to be approved for device B which I do not want as it is friction for the user. Again this is all in the background and not applicable to their usage of the app. So to summarize:
- Do not store key or decryptable key on my servers
- Customer does not have to enter a password or anything like it
- Both devices do not need to communicate (offline)