Writing data: User Data -> [Encryption in browser via "Secret Key"] -> Encrypted data -> Server
Reading data: Server -> Encrypted Data -> [Decryption in browser via "Secret Key"] -> User Data
I have two ways of performing the encryption:
Method 1: - Encrypt using the "Secret Key" provided by the user and send it to the server for storage.
Note: This method would make changing the "Secret Key" cumbersome. All data should be imported to the client, decrypted with existing "Secret Key" and encrypted with the "New Secret Key".
Method 2:
- Generate a "Random Key" on the client side which will be used for encrypting the data.
- Store this "Random Key" encrypted using the "Secret Key" provided by the user on the server - "Encrypted Random Key". - For decryption, decrypt using the "Secret Key" to obtain the "Random Key", use this for decrypting further encrypted messages.
Note: Changing password is much easier with this, I will have to decrypt "Encrypted Random Key" to get "Random Key" and I can now encrypt it again with the "New Secret Key".
I have two questions here:
1. While method 1 can be clearly classified as End to End encryption. I wanted to know if I can classify method 2 as End to End encryption as well?
2. Would you as a user be comfortable using an app which uses method 2 for storing your personal information.
Thanks in advance.
It appears that there is only one "end" here. So I don't see that there is any reason to make some sort of distinction between what you are doing and just straightforward and secure encryption.
What you are doing sounds more like this: