• caglararli@hotmail.com
  • 05386281520

Save private key in a database to share between multiple accounts

Çağlar Arlı      -    12 Views

Save private key in a database to share between multiple accounts

I don't know if my concept would be secure so I ask here. The main purpose is to log in with password x and also use that password to encrypt an RSA private key with AES to store that in the main database, so when I log in with another account that private key can be reused and I can encrypt all incoming messages with that private key, so other users only need one single public key from me.

Due I don't want anyone to be able to read the message I use that RSA encryption but I also don't want the server to be able to know the AES password.

So my thought was that I use password x and hash it with PBKDF2WithHmacSHA512 and use that first hash as the AES password. Then I hash the hash again with the same algorithm and use that to log in in my account. So the double-hashed-password will be sent to the server and will be treated as my account password. With my understanding the server will never know what the AES password is so will never be able to get the private key.

The private key will be generated when no private key is in the database yet, encrypted and sent to the database. When I log in again I will get this encrypted private key and can decrypt it.

Now I'm wondering if I'm missing something. Would that be secure?