The best method for requiring two keys to estimate a symmetric crucial?

I need to create an app that includes facts that is encrypted (using AES, but which is irrelevant). The knowledge is decrypted in a world-wide-web browser that involves a mix of two keys: 1. A important regarded only to the user, these kinds of as a passphrase (let us phone it `Ku`) 2. A important saved in a server and is only offered to the browser soon after sure credentials (`Ks`) are confirmed. The trouble I am striving to resolve is that no party (consumer or server) really should be equipped to decrypt the info making use of only a person of the two keys. Only the browser is allowed to decrypt the important after the user has typed a passphrase (which is not despatched to the server) and acquired 50 percent of the essential from the server (after authenticating himself). `Ku` is a consumer-outlined passphrase this is with any luck , sturdy enough (with more than enough entropy). `Ks` can be generated randomly, e.g. be a string lengthy enough (these types of as 32 random bytes, perhaps encoded as foundation64). There are two tips I’m looking at and would like your opinion on them: 1. Use a crucial that is `KDF(Ku || Ks)`, i.e. concatenate the two keys (as basic strings) and use then a KDF to derive a symmetric important. (`Ks` could be base64 encoded in this case – it would nonetheless be 256 little bit entropy) 2. Use a (static) ECDH to complete a critical match. In this circumstance `Ks` would be the private vital of the server. `Ku` is the user’s personal critical wrapped with a passphrase (that is, converting the user’s passphrase to a critical with a KDF, then we use AES-KW per RFC-3394 to help you save the personal EC- to pack the essential). Ideas on the above? Or is there a far better possibility? (As for KDF, that will in all probability be Argon2id, but any solid KDF should really get the job done)

The best method for requiring two keys to estimate a symmetric crucial?

About Cryptoplatforming.com

Cryptoplatforming.com is a news websites which gets news around the globe on investing in Crypto. Our news has no backgroundcheck.