HACKER Q&A
📣 krisys

Can I classify this as End to End encryption?


Hello all, I am working on a personal project where I plan to store user information on a server in an encrypted form. This is roughly the architecture of my app.

Writing data: User Data -> [Encryption in browser via "Secret Key"] -> Encrypted data -> Server

Reading data: Server -> Encrypted Data -> [Decryption in browser via "Secret Key"] -> User Data

I have two ways of performing the encryption:

Method 1: - Encrypt using the "Secret Key" provided by the user and send it to the server for storage.

Note: This method would make changing the "Secret Key" cumbersome. All data should be imported to the client, decrypted with existing "Secret Key" and encrypted with the "New Secret Key".

Method 2:

- Generate a "Random Key" on the client side which will be used for encrypting the data.

- Store this "Random Key" encrypted using the "Secret Key" provided by the user on the server - "Encrypted Random Key". - For decryption, decrypt using the "Secret Key" to obtain the "Random Key", use this for decrypting further encrypted messages.

Note: Changing password is much easier with this, I will have to decrypt "Encrypted Random Key" to get "Random Key" and I can now encrypt it again with the "New Secret Key".

I have two questions here:

1. While method 1 can be clearly classified as End to End encryption. I wanted to know if I can classify method 2 as End to End encryption as well?

2. Would you as a user be comfortable using an app which uses method 2 for storing your personal information.

Thanks in advance.


  👤 upofadown Accepted Answer ✓
I guess the first question is: why do you care if what you are doing is in some sense end to end encryption? End to end encryption has a reputation of being hard to use as it normally has an identity verification requirement. Why would you want that association?

It appears that there is only one "end" here. So I don't see that there is any reason to make some sort of distinction between what you are doing and just straightforward and secure encryption.

What you are doing sounds more like this:

* https://en.wikipedia.org/wiki/Client-side_encryption