Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

4
  • Does (A) need to be able to access this secret identity information, or is it just holding it for (B)? Commented Jan 12, 2016 at 20:49
  • It's holding it for (B). The idea is that if a hacker hacks (A), without a private key from (B), he's going to be out of luck. And no amount of intercepting the web traffic on (A) is going to help. I'm just trying to do this in the most secure, industry-standard way. Commented Jan 13, 2016 at 1:51
  • In that case, why does (A) need any knowledge of encryption at all? Just have (B) pass in the data already encrypted. Commented Jan 13, 2016 at 13:46
  • Okay, I posted a preliminary answer. Do you think this can work and is a best practice? Commented Jan 13, 2016 at 20:56