3

lets say I want to encrypt data inside the browser (via JavaScript, using PGP). Since it is not save to store the keys in the browser (LocalStorage), I want to have them on an external device, like a YubiKey, which provides PGP encryption / decryption.

So, the user writes some secret text, plugs in his YubiKey, presses some button, the secret text goes to the YubiKey, which encrypts it (while the Key for the encryption stay on the YubiKey and then returns the encrypted text. Same for decryption.

Is something like that technically possible? If not, where else would I keep the keys for the encryption?

TSM
  • 189
  • 2
  • 9

1 Answers1

0

Currently there is no way to access such a device using a browser. There are some plans to add such a feature, yet it's still in the editor's draft stage, so it may take some time until it releases as a standard. Of course, not every browser may not support that feature when it becomes standard.

Regarding your question, I think you could try storing the key on the server if you really need a good protection.

The first time the key is generated, the user could create a kind of an account with the password and random GUID generated by the server (to make sure there won't be double GUIDs existing on the server - I know there is almost no chance to occur such a situation, but it's also a good layer of additional protection). You could store the GUID on the client side (for instance in localStorage), so that the user won't be prompted each time for it. User must be noticed though that the key needs to be saved somewhere on disk in case the localStorage is cleared. Then when the account is created, the key would be transmitted securely (via https) to the server, key's name would be the generated GUID.

Once account is created and you would like to receive the key from server, the browser would have to make an ajax request - user has to provide his/her password and a keyID (GUID) if it wasn't exist in the localStorage. Once the server matches the keyID with the password, it would return the key. You could decrypt your text using the password and received key.

Jakub Rożek
  • 2,110
  • 11
  • 12