Take the 2-minute tour ×

I need to store an encryption key locally in order to allow a user to use my CouchApp in a disconnected mode. The data that I will be sending is very sensitive and requires encryption by law. However, we would like to offer full access to data when running disconnected. Currently we have a password key generator, but this would require the user to enter their password every time they want to view a record. Also this doesn't seem to be secure as an experienced/advanced user could potentially access the encryption key, and then the Local Database. I'm basically wondering if anybody has experience with the disconnected security model, or if you can offer any pointers on how to allow access while maintaining security.

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

If your client is connecting directly to the database then all users have access to the entire data set. Apparently you trust your users... with everything. This feature right here breaks the most common data protection models. An attacker doesn't need sql injection or insecure direct object reference, he can just grab whatever he because you are giving him everything.

I don't see how cryptography solves your problems. It looks like a textbook CWE-602 violation.

share|improve this answer
Are you familiar with a CouchApp? The idea behind this is this is that the database is served locally, and replicated from a master copy. The user does not have direct access to the database without a password, and the data is encrypted locally. However this means that somehow, I need to store the decryption key, or at least part of it locally. (this is if I continue to use our partial key gen from password method). –  Jlange Nov 11 '11 at 16:20
@Jlange See encryption can never work that way. A user of the device has more control than you do as a developer. There is no place to hide a secret that the attacker cannot find. You are trusting the user with everything. –  Rook Nov 11 '11 at 19:11
@Jlange So wait can a device just upload their own copy of the database just overwriting everything? Outch dude, that's real bad. –  Rook Nov 11 '11 at 19:13
Theoretically they could overwrite everything, but there would be no point, as the old data would just be replicated down as soon as they regained connectivity, overwriting whatever the user chose to put in. Also, assuming they have access to the data, (which they would need a user password to access), the data is encrypted. I see what you mean that user has everything, as in order to make this encrypted data useful they would need the decryption key. –  Jlange Nov 15 '11 at 18:04
My original question was looking for any ideas how to store this decryption key. It seems that it would not be possible to store locally...at least not maintaining security. –  Jlange Nov 15 '11 at 18:06
show 1 more comment

Your Answer


