Design an encrypted key-value store with login
Design an Encrypted Key-Value Store with User Login
Design a small key-value store that supports user login and ensures values are encrypted at rest using a user-provided password.
You may assume this is a standalone service or library (language-agnostic) and you can use standard cryptographic primitives from a library (you do not need to implement AES/SHA yourself).
Requirements
- Authentication / Login
- Users can register and then log in with a password.
- The system must not store plaintext passwords.
- Encrypted-at-rest values
put(key, value)stores the value such that if the underlying database or file is leaked, values are not readable without the user’s password.get(key)returns the decrypted value for an authenticated user.
- Basic API Surface (suggested)
Register(username, password)Login(username, password) -> session/tokenPut(session, key, value)Get(session, key) -> value- Optional:
Delete(session, key)/ListKeys(session)
Threat Model / Constraints
- Assume an attacker can obtain the underlying storage (database or file) but not the running process memory.
- Consider common cryptographic pitfalls, such as deterministic encryption, IV reuse, and the distinction between password hashing for authentication versus key derivation for encryption.
What to Provide
Candidates should provide:
- A high-level design (data model + flow) showing how to store:
- User credentials
- Encrypted values
- Any metadata needed for decryption
- A description of cryptographic choices and why they are safe.
- Key edge cases to consider, such as password change, data corruption, wrong password handling, and multi-user isolation.
AI interview prep
Core dilemma
Securely deriving and managing user-specific encryption keys from passwords for data-at-rest encryption, while maintaining robust authentication and protecting against various data leakage scenarios.
3 tradeoffs and 3 stress tests locked
Interview prep
Unlock the interviewer X-Ray rubric, tradeoff matrix, stress tests, clarifying questions, and key concepts.
Design an encrypted key-value store with login
Design an Encrypted Key-Value Store with User Login
Design a small key-value store that supports user login and ensures values are encrypted at rest using a user-provided password.
You may assume this is a standalone service or library (language-agnostic) and you can use standard cryptographic primitives from a library (you do not need to implement AES/SHA yourself).
Requirements
- Authentication / Login
- Users can register and then log in with a password.
- The system must not store plaintext passwords.
- Encrypted-at-rest values
put(key, value)stores the value such that if the underlying database or file is leaked, values are not readable without the user’s password.get(key)returns the decrypted value for an authenticated user.
- Basic API Surface (suggested)
Register(username, password)Login(username, password) -> session/tokenPut(session, key, value)Get(session, key) -> value- Optional:
Delete(session, key)/ListKeys(session)
Threat Model / Constraints
- Assume an attacker can obtain the underlying storage (database or file) but not the running process memory.
- Consider common cryptographic pitfalls, such as deterministic encryption, IV reuse, and the distinction between password hashing for authentication versus key derivation for encryption.
What to Provide
Candidates should provide:
- A high-level design (data model + flow) showing how to store:
- User credentials
- Encrypted values
- Any metadata needed for decryption
- A description of cryptographic choices and why they are safe.
- Key edge cases to consider, such as password change, data corruption, wrong password handling, and multi-user isolation.