I am building an application where users send files with a password for encryption to a server via ssl. They can then share the encrypt files with people
I will then build a desktop application in C++ where a user can select the file and decrypt it locally on thier desktop with a password
Option1:PGP My first thought was to use pgp, now if i securely stored a private and public keypair on the server then all users files could be enceypted easily enough on the server with the users password. But my desktop application wont be able to decrypt the file with just a password i would have to bake the private key into my desktop application
Question1: if my desktop application is compiled could an attacker decompile the application and get hold of the private key, is there a way to securely store data in a compiled program to prevent such a breach.
Option2: AES Another method i thought was that i use a hashing algorithm to hash the users password and then use that hash as a key for encrypting the file using AES encryption. Then on my desktop application i use the same hashing algorithm to recreate the key when the recipent of the file enters the password to decrypt the file
Question2: same problem, if an attaker decompiles my program and see what hashing algorithm im using am i back to square one, now they can just generate hashes and brute force the file open
Question3: does anyone know of a better way to implement this