How to store encryption keys for user data with processing on the server?

Question

Information Security

Hello. Suppose there is a database that stores user data (logins and passwords for third-party resources that do not have an API). For obvious reasons, you want to save these accesses, but at the same time they will be used by the server to collect data from these resources.
I plan to encrypt this data in the database with a key that is unique for each user. The question arises where to store the encryption keys. If on the server, then there are two options:

• in a separate database, but here you need to think about how to secure this database already.
• in the keystore on the server.

I don't like server storage options.
If on the client, then keep the key in cookies or in local storage, encrypting and decrypting data on the client and updating the key from time to time. But then I would need to send the decrypted data back to the server for it to use it. Is it possible to do so?
The problem is that I am solving such a problem for the first time and I doubt every step. Tell me, please, how?

Answer 1

There are 2 obvious high-probability risks in your threat model:
1) obtaining administrative privileges on the server (no encryption will save you from this, since your server is forced to send the password to the polled server in clear text, and, therefore, the attacker "hung" for a day-week-month will still intercept all passwords in the clear);
2) stealing the database and / or code without obtaining administrative privileges - then decide for yourself - either you encrypt the data on the key information of the client, or, for example, on hardware tokens (but then when you restart the service, please enter the PIN manually every time - this is done on serious HSM modules)