title: Saving a crypted private key in a cookie
body: <p>I am currently working on a project with a lot of security and I am having a bit of a problem choosing a technical solution to satisfy my customer need.</p>
  
  <p><strong>First things first, let me explain you the customer need.</strong></p>
  
  <p>For my customer's website, at some point a user needs to generate a <em>private key</em> and <em>public key</em> client side (gui : <em>browser</em>) then send the public key to the server and save the private key (<em>crypted</em> by a user choosen password) locally. The private key needs to be saved because it is used once in a second part of the process (the user needs to enter his password in order to decrypt it), once used we can dispose of the private key.</p>
  
  <p>I have to add that the customer requests backward compatibility to IE7.</p>
  
  <p><strong>First technical choice : Java Applet</strong></p>
  
  <p>The first thing we looked up is to use a Java Applet, generates the keys just fine, but we enconter a problem on Safari Mac OSX, the appet is sandboxed and the user needs to perform a complicated action to disable sandbox mod. Our customer does not want this as it is not user firendly.</p>
  
  <p><strong>Second solution : Saving crypted private key in a cookie</strong></p>
  
  <p>We kept the java applet, but it does not save anything on disk, it is only used to perform cryptographic actions. We passed from the applet a crypted private key to the javascript to save in a cookie. We did it fine and we can retrieve the crypted private key from the cookie store and pass it to the applet to decrypt (with a popup requesting the user to enter his password).</p>
  
  <p><strong>Question</strong>
  We know that it is technically doable to save a crypted private key in a cookie, but the question is : is it secured, what kind of risks are we taking saving that private key in a the cookie store of the browser?</p>
  
  <p>It would help me a lot if one of you could help me!</p>
  
  <p>Cheers</p>