0
$\begingroup$

Hey guys I'm not a crypto expert so apologies if the question is especially noobish.

We have a web application that requires the user to sign certain messages. We have been storing the secret key in LocalStorage inside the browser, but in light of the new Safari rules where they force clear all script-writeable storage after 7 days of non-interaction with the site, I need to think about alternatives. I actually asked about this question in another stackexchange post here.

Here are my goals,

  1. The app server cannot know about the secret keys (obviously)

  2. Figure out a way to generate new keys (once they're forcibly wiped by the browser) but still be able to link the new key to the past keys (maybe involving the user's password somehow?)

Since these keys are meant to establish identity (no financial assets are involved), the website could just keep generating new keys locally if they get wiped. The trick is how do I associate the different keys to show that they come from the same person?

My web application does have a user account system with the email as id, and a password of the user's choosing. So the user is on the hook to remember the password. So here's my question: is there some way for the site to generate new keys (after they got forcibly wiped) but somehow base the new key generation on the user's password? So later on I can somehow prove that, although we have all these different signatures, they're "related" because somehow they involve the same seed of some sort?

Looking also at how ProtonMail handles secret keys. They don't have the problem of the browser wiping your keys, but with their method if the user forgets their password then there's also no way to link it to the past signature.

Another way I can think of is via social validation. The messages the users are signing are in fact communications between many people. So if the user forgets their password and has a new key, perhaps they can get say at least 3 of their past correspondents to vouch for their new identity.

  1. If the user's password is involved, how to preserve this linkage if the user forgets & resets his password?

Any help / guidance would be appreciated. Safari jumped the gun on this one, but Chrome has the same plan only to be implemented by 2022. The only other w

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.