I have a specific use case I am interested in. I have spent the better part of the night reading research papers. I am beginning to believe what I want is not possible so I wanted to confirm here.
Scenario: I have customers with a private key. However, this private key is on the device they installed my software on. They have no clue what or why they have a private key and could care less. This is important for using the software. They can also use the software on their phone, not just their desktop. I need a way to get that private key on both devices without them communicating with each other but only through me. I, however, do not want to be in contact with the raw private key.
I am happy to store an encrypted version of this key but I don’t want the ability to decrypt it.
I am also aware of the fact that I can use a password. So device A can have the user enter a password which can be used to encrypt the key and then they can send it to me to store. Then on device B, I can send them the encrypted key and they can use the password to decrypt it. This is trivial.
The key requirement I am trying to get to is I don't want a user to have to enter a password on each device to be able to decrypt the key. The only passwordless solution I found in my research requires the devices to communicate to agree on a key. This would mean both devices have to be online at the same time. So the only real-world way to do this is to have a user perform an action on device A ( if not online ) to be approved for device B which I do not want as it is friction for the user. Again this is all in the background and not applicable to their usage of the app. So to summarize:
- Do not store a key or decryptable key on my servers
- Customer does not have to enter a password or anything like it
- Both devices do not need to communicate (offline)