I'm trying to build an end-to-end encrypted cloud note-taking system but don't want my users to have to deal with any form of key management. Is there any way to achieve this? One idea is to have users use a seed-phrase to login which a keypair can be deterministically generated from. Is this a reasonable solution? Are there any other solutions with better UX?

  • $\begingroup$ There have been several questions / answers here with regards to deterministic key pair generation for RSA. There are many problems with it, for instance that password changes would be extremely tricky. Generally most people here advise against it but it can be done. Personally, I think that forgoing key management is not the right idea, I think you should make key manegement at least easy or even transparent for the users. If you do key pair generation I would advice using DH or Elliptic Curves. $\endgroup$ – Maarten Bodewes May 5 '19 at 20:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.