Reffering to the question provided by me: "Where and how to store private keys in web applications for private messaging with web browsers?" which means that I want to find a bullet proof mechanism to permanently store and protect public keys in web-browser for end-to-end encrypted messaging without needing more than:
- web-browser
- HTTPS support
- javascript
- permanent storage within the browser
I had to sadly accept, that there is no answer (which is perfectly secure) to my question.
I want to justify this statement by providing a summary of the comments section discussion and refer to some external sources to undergird the weak points within the destination environment.
- Storing Private Key in a Cookie - This approach is very straight forward, but also involves some security issues. First of all a cookie is sent within each http request if the "URL requested is within the same domain and path defined in the cookie" - Stackoverflow which means that the private key is transmitted to the server with each http request of the user owning the private key. The client-server communication is protected through HTTPS but if the server is compromised then the private key is leaked. The next problem associated with storing secrets in cookies is that if the cookie expires or is removed through browser settings or by the user himself, then the private key gets lost forever.
What about storing an encrypted private key in the cookie and a backup of this encrypted private key on a secured client-side data storage device?
Well, that is an option. Let's assume that the user could encrypt the private key with AES and a strong password remembered within the users mind. Then even if the cookie is transmitted over a secured line to the server with a compromised application running, than the adversary could not accomplish anything with the encrypted key. And if the cookie expires or is removed from the browser the user could restore it through his external backup. At this point of writing we could think we have resolved the problem. I'll show you that we unfortunately have not, but before I will provide you a vivid example, I have found on a website during my research (but unfortunately I've lost the URI), why transfering the private key even if encrypted and over a secure line is not rational at all. Imagine you have made some very private pictures of yourself, you have encrypted these pictures with a strong password and a secure crypto mechanism, anybody could decrypt these pictures within the next millions and millions of years, but you would not send these encrypted files to your friends, because you'll feel uncomfort about the risk of decrypting your pictures by one of your friends. You should also feel uncomfort about transfering these encrypted private keys to a server.
- Client-side javascript encryption - at the time of writing this answer there are different javascript encryption libraries, one of the most advanced is the "Stanford Javascript Crypto Library (SJCL)" which can be used to encrypt data like, in our case, the private key. The problem about client side encryption with javascript is that an adversary could inject malicious javascript code through compromised servers or cross-side-scripting attacks. You cannot sign your javascript files (at least not with the questions system requirements) and you cannot verify the entire document to be trustworthy. So an adversary could steal users private keys before they are encrypted or when they are decrypted through the users password. For further explanation I would reffer to the URI provided by @ArtjomB. Javascript Cryptography Considered Harmful
At this point I have provided enough serious security problems, that any further discussions about the question with the requirements listed above is senseless. But for completeness I will have a look at further solving approaches discussed in the comments.
Browser plugins - Browser plugins do not match the system requirements listed above. For further explanation about browser plugins have a look at (Javascript Cryptography Considered Harmful)
Web Storage API - Better solution than storing in cookies because offline content without transfering values with each http request, but still vulnerable through malicious javascript and xss.
Conclusion: With the system requirements listed above there is no secure way to accomplish what I asked for. JavaScript is no suitable language for client-side encryption (see Javascript Cryptography Considered Harmful) and Browsers are not designed for this purposes at the time of this writing.
