Mailing-List: contact user-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@couchdb.apache.org
Received-SPF: pass (nike.apache.org: domain of jens@couchbase.com designates
 206.225.164.28 as permitted sender)
From: Jens Alfke <jens@couchbase.com>
To: "user@couchdb.apache.org" <user@couchdb.apache.org>
Date: Wed, 9 Nov 2011 13:13:57 -0800
Subject: Re: Handling encryption keys in a disconnected environment
Thread-Topic: Handling encryption keys in a disconnected environment
Thread-Index: AcyfJH50GoauOfP+RFW+UNCXAVfzZQ==
Message-ID: <EA33F3BA-B543-41A0-AC8E-C1CBBC935228@couchbase.com>
References: 
 <CAC6CsmbZnGaCanP1HqvcHu4tytfPf1QrawynPHMMjpK5ZhsPHg@mail.gmail.com>
In-Reply-To: 
 <CAC6CsmbZnGaCanP1HqvcHu4tytfPf1QrawynPHMMjpK5ZhsPHg@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
acceptlanguage: en-US
Content-Type: multipart/alternative;
	boundary="_000_EA33F3BAB54341A0AC8EC1CBBC935228couchbasecom_"
MIME-Version: 1.0

--_000_EA33F3BAB54341A0AC8EC1CBBC935228couchbasecom_
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable


On Nov 9, 2011, at 9:58 AM, Jay Zamboni wrote:

we want the client application to be able to decrypt data
even when it cannot connect to the server.  This seems to force us to store
the decryption key on the client with the encrypted data.  Storing the key
locally seriously weakens our security so we would want to at least encrypt
the stored key with the users password(+salt).

Is this a pure web-app or will it have native components? iOS has APIs for =
storing secrets like keys in a secure encrypted =93keychain=94. I=92m sure =
Android has a similar feature. (Even if you=92re going to use a wrapper lik=
e PhoneGap to package your app for mobile devices, then that=92s likely to =
have JavaScript bindings for those APIs.)

           Encrypt key using session id and store in couch
As the user goes from page to page we would use the session id to load the
encryption key.  When the user logs out or the session times out, the
session id should not exist anywhere.

I don=92t know the implementation details of how CouchDB tracks sessions, b=
ut if it stores the currently active session IDs on disk, then this won=92t=
 be secure, as an attacker can look at the server=92s files and locate both=
 the session key and the server key that was encrypted with it.

=97Jens

--_000_EA33F3BAB54341A0AC8EC1CBBC935228couchbasecom_--