I am building an app which uses asymmetric encryption (each user has a private/public keypair)
Users use those keys to interact with encrypted data coming from the database.
Problem
- User changes device.
- The private key (stored locally in old device) is not available now.
What I know
I have read this post so I know that one way to do it is using a brain key and deriving it from a user's password.
Problem => I am also using Google & Apple Login, which don't require a password, so I can't derive the brain key.
What I Need
- The easiest way to transfer or derive the private key from the other phone's local storage (QR Code? Custom API? How does WhatsApp do it?).
- Or a way to derive the
brain keywith other types of logins (if possible). To find the equivalent of a password when using Google or Apple login APIs, something that is secret but constant for every login on every device.
Note: The app is already live and has ~500 users with different types of logins. Encryption will be introduced in the new version.
Solutions I have thought of
Transferring through QR Codes...The old device generates a QR Code that contains the private key. The new device scans that code and gets the key.
Nothing is transferred through the internet...so is this safe?
Another solution is to require an 'app paassword' no matter the login type. In that way you can derive a password with social logins too.
Will this be too much strain for the user? Do other apps use this method?