I am working on encryption/decryption for the rest of the API. The client here can be mobile, desktop, web browsers, etc and all the requests will be made to an https endpoint.
The main goal here is that the encryption/decryption has to be performed in client-side applications. The user himself should not be able to monitor the request/response made from his device(phone, browser, etc) and be able to perform encryption/decryption by himself. He should not be able to see the request/response in cleartext. Everything should happen in the client-side application.
For every request it should follow the steps as follows :
- Client application encrypts the request data and makes an API call
- Server decrypts the data and performs operations
- Before sending the response back to the client application, the server encrypts the response and sends it
- Client application decrypts the response and uses it
I had planned to use AES-256 but faced the following problems :
- Secret key has to be stored hardcoded in the client-side applications. Doing so won't be safe
- Getting the secret key every time from a rest API is not safe either as the request can be monitored and the key can be fetched from the response
I had planned to use AWS KMS service but faced the following problems :
- For every encryption/decryption to be performed the client side has to login to AWS and then use the KMS service
- If the login request is made then the request can be monitored again and the access key and secret key can be fetched from the response/request and then once the login access is gained, anyone can use the KMS service to encrypt/decrypt data
I did check articles where the secret key should be separate for each user and should be based on password but in my case User can log into to client-side application as a guest user so there won't be any password, email that has to be provided.
Not very sure how separate keys can be used for each user as the encryption/decryption has to be performed every time on both the client and server-side.
AES-256 is considered to be safe but I still didn't find any ways on how can a private key be managed on the client-side. Any help here on how can AES, KMS be used? Any other solutions would be fine too.