Here is my structure:
- A database where I store sensitive information.
- A frontend app where the user interacts.
- A backend to receive interactions and manage data accordingly
- Keycloak for auth
I have been reading a little bit, and I have concluded that storing sensitive information in the database could pose security risks.
A solution could be to use zero knowledge encryption:
- user authenticates with password
- frontend uses the password to encrypt data sent to the backend
- backend stores encrypted data
The problem is that I have no access to the password since Keycloak stores it internally. Do you guys know if there is a way of implementing a solution like this? or a better alternative? I am new to cryptography.