Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement the Zero-knowledge Server #31

Open
merlos opened this issue Feb 12, 2025 · 0 comments
Open

Implement the Zero-knowledge Server #31

merlos opened this issue Feb 12, 2025 · 0 comments
Labels
enhancement New feature or request security

Comments

@merlos
Copy link
Owner

merlos commented Feb 12, 2025

The current implementation performs the encryption in the server side. Whereas the server does not store the password, when a new lacrado message is sent, the message itself as well as the password is sent from the client to the server, then the server using that password as key encrypts the message.

The problem with this approach is that if the server gets compromised, then messages can be exposed on submit time or on read time.

The solution would be to perform the encryption in the client side, so the server only receives the encrypted message, and the metadata about the number of times to be seen or the expiration date.

@merlos merlos added enhancement New feature or request security labels Feb 12, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request security
Projects
None yet
Development

No branches or pull requests

1 participant