title: How should I savely store encrypted user data on my server, and serve it only to the right user?
body: <p>Let's assume I must store user's sensitive data, which was optionally encrypted on the client side.</p>
  
  <ul>
  <li>Encryption (optional) should be done with user's <strong>passphrase</strong>.  </li>
  <li>User login (optional) should be done with user's <strong>password</strong>.  </li>
  </ul>
  
  <p>Notes:<br>
  A plain-text password is not stored on the server or transferred over the network.  </p>
  
  <p>My options and their drawbacks:</p>
  
  <p><strong>1. No authentication, Client-side authorization:</strong><br>
  The server gives the data to everyone, but only the original user have the means to decode.<br>
  <em>Data can be used by <strong>anyone</strong> to try to crack the encryption - not the best way to secure it.</em></p>
  
  <p><strong>2. Server-side authentication, no authorization:</strong><br>
  Server stores user's password to access the data, and only gives the data to the user that can provide the right password.<br>
  <em>Users don't trust the network for transferring their data <strong>without encryption</strong>.</em></p>
  
  <p><strong>3. Authentication and authorization:</strong><br>
  Server stores user's password to access the encrypted data, the encryption is done using the passphrase that is different from user's password.<br>
  <em>Good security, but users don't want to remember <strong>two passwords</strong>.</em></p>
  
  <p><strong>4. Authentication vs. Authorization:</strong>
  Server stores user's password to access the encrypted data, the encryption is done using the same password.<br>
  <em>Users are happy. Some security concerns.</em></p>
  
  <p>I prefer the latest fourth option, but my concern is:<br>
  What if the server will get compromised, how can I be sure that encrypted password and encrypted data can't be used together to break the encryption?
  How can I make it harder to break the encryption?</p>
  
  <p>Some thoughts:</p>
  
  <ul>
  <li>Use different encryption algorithms for password and data.</li>
  <li>Add fixed string to the end of the user's password before encryption.</li>
  <li>Pad user's password to some length.</li>
  </ul>
  
  <hr>
  
  <p><strong>EDIT:</strong></p>
  
  <p>The system should be very similar to a backup system that should be secure from all sides: the server should not be able to read the data, only the original client should be able to access the data and man in the middle attacks should be prevented. So if someone hacks the server authentication or the client encryption, the data should not be revealed.</p>
  
  <p>It should be web based, so the man in the middle attack should be prevented with HTTPS.</p>
  
  <p>To prevent server hacks revealing the data, the data is encrypted in client-side.</p>
  
  <p>To prevent client encryption tampering, the access to the data should be protected on the server side with some log in and password or a token (may be unique URL).</p>