currently we're working on a small application where we store a bunch of JSON data coming from a JS-based graphing editor (think of a spiced-up version of this) in a Rails-based backend. We want to allow users to store the data encrypted (AES, RSA, whatever), where we as the application maintainers have no possibility of decrypting what's lying in our DB - given a strong password of course. There's no user account management, nothing. People are only able to create and edit their graphs via a secret link, nothing more nothing less.
The password would then be needed to encrypt / decrypt the graph coming and going to the DB before editing or saving the current state. Now, the conceptual questions we're facing right now are the following:
Do we store the password throughout the session? If not the user would have to enter the password every time he refreshes the browser or wants to save the current state of his graph into the DB. Uncomfortable...
If - from a software engineering perspective - this is applicable: Where does this kind of information gets stored in general? What options apart from cookies do we have?
If so - would we have to store the plain password or is there a way to somehow encrypt the password so that in case of a stolen cookie an attacker would face a more difficult game getting the password?