Best practice for private key backup flow on mobile

Question

The mobile app I'm working on is using end-to-end encryption algorithm. User creates a private key to read data that is saved on the server. The key is being stored on a device and can be exported to a file.

When user chooses to use app on a different device, he/she should be able to import the private key in order to read out the encrypted data.

What could be the best, and still, safe experience for a user to create a backup of the private key file?

One of the options could be exporting the key to the cloud. The key could be also printed out, although the limitation is the mobile – it can get tricky for some users to print out directly from the device.

Do you know any apps, or solutions that could nicely solve this problem?

Answer 1

If you use any kind of "cloud" distribution system (either something like Dropbox or your own servers), then good security policy would dictate that the private key should neither be transmitted nor stored "in the plain". In general, you would want to encrypt it with some kind of user-entered password that they can re-enter on the new device to gain access to the key. However, the question of exactly what mechanism you use is probably better directed to the Security StackExchange site.

One possible non-cloud method of transferring the key from one phone to another, when both are in the user's possession, would be to display a QR code or similar on one phone (that represents the key) and have your app use the camera on the second (new) phone to capture it. Because this can be done "in private", there is probably less need to encrypt the private key (although some threat-models, for particularly sensitive data, might still require this).

Another option might be to use Bluetooth to send the private key from one device to another.

Answer 2

In case the remote server receives only encrypted data, there is no other choice, but to emphasize in the application that it won't be able to read data on another device without the appropriate private key (that should be exported manually by an end-user).

Novice or Expert Users Audience?

If such mechanism is not obvious to the intended audience, if possible, it's better to go with higher requirements to a password that can be used for encryption of the private key itself that will be transparent for app users.

Even a strongest private-key won't benefit security if it's left printed on a office desk.

Existing Solutions

Speaking of examples, you may want to consider how cryptocurrency wallet applications handle this issue.

Answer 3

While I don't know the exact form of your private key, but to extend Tripehound's answer, one possible direction to approach your problem would be by sharing the key in the same way as 2FA apps such as Microsoft Authenticator etc. do when setting up a new 2FA for any account—by getting the user to enter a code (or scanning its corresponding QR code) visible on a pre-authenticated device. The entered code then acts as a piece of the puzzle in replicating the private key on the new device.