Storing a key on a server rather than a client has some advantages, for example that I can move seamlessly between clients, or don't have to store the key on a client. As an example, consider a Dropbox-style site offering encrypted storage: with some PAKR scheme I can access my data from another device, but only have to know my password.
Other scenarios:
- a cloud-based password manager that lets me sync keys between devices, without having to trust the server with my plaintext passwords
- an E2E encrypted messaging web app that I can access from any browser
- a cloud-based Bitcoin wallet
- secure backup
There are different approaches to store the key on one or more servers without giving any server access to the key.
For example, I have a passphrase and a main key. To store the main key on a single server:
- I use a key derivation function to derive a key from this passphrase.
- I encrypt the main key with the derived key.
- I store the encrypted key on the server.
To retrieve the main key:
- I derive the key from my passphrase.
- I load the encrypted key from the server.
- I decrypt the main key with my derived key.
This scheme requires that this passphrase is only used to derive the key, but not to log in to the server: at no point may the server get the passphrase or they could access the plaintext key. However, authentication is possible without transmitting the password, e.g. challenge-response techniques with a shared secret derived from the passphrase, or a public/private key derived from the passphrase.
With web-based software, another problem is that the server storing the encrypted key often also provides the software to encrypt the key. If the server is compromised, the encryption software could be modified to exfiltrate the plaintext key or the passphrase.
There are also approaches that divide parts of a key over multiple partially-trusted servers. To compromise the entire key, multiple servers would have to be compromised. To access the key parts, I need to authenticate myself to at least as many servers in order to reassemble the full key. I can use separate key derivation functions to generate per-server authentication tokens from a single passphrase.
As a practical example, read the whitepaper for the 1Password password manager, in which clients use the login password + a secret key to derive a Master Unlock Key which can then be used to decrypt keys/passwords from cloud based storage.
