Where to Store Private Keys?

Question

I'm building an app that I want to have E2EE. My struggle is with the private keys. Most of what I read they say you don't store it in AWS servers because it will not be an E2EE anymore and it's a backdoor. I don't want to create a backdoor, I want the user ONLY to hold the key. However, at the same time if the user logged in from another device, they cannot retrieve their data coz the private key on the original device.

So what are some ways to let the user be able to login from another device without having a trouble retrieving the data and not putting their private key on risk!

Please consider that I'm new to this subject and I'm using cryptoKit from Apple :) Thanks!

Answer 1

You can use the user’s id and password hash (for example) to encrypt the private key and store the encrypted version of it on the server.

1. Encrypt the private key locally using the user's id and password (or a hash of it)
2. Send this encrypted key to the server to store it there

Now when the user logs in from another device, the encrypted key can be retrieved and decrypted locally using the user's id and password.

Thus, it won’t be possible to decrypt and use the encrypted key without the user’s credentials. However, this also means that if the user changes their password, the encrypted key also needs to be decrypted with the old and re-encrypted with the new password.

That’s the usual approach for your requirement.