Question

Suppose you have a server-client application.

Server keeps sensitive information that belongs to a Client.
Server will search some parameters in side the clients’s sensitive information.
Thus server should decode the sensitive information with client control temporarily.
But server should not reveal the keys, by hacking it self.
I mean a developer should not try to change server sidde code and should not extract the client keys.

Is there really a way to do that?
Somewhat client permits server to decode sensitive information, but the keys instantly disappear and developer have no tricks to reveal this password?

The answer if exist, is valid also for an ideal secure cloud application. Developer or cloud hosting company should not access to decrypted information.

I am not optimistic, but worth to try asking.

Answer 1

So in a word no. This does not grant any security whatsoever, as you cannot trust the client. You even call out that the server will be controlled by the client temporarily, this is generally not a wise approach. Also, do not underestimate a bored developer, it is completely feasible to write some code and rip the keys. The key here is remembering that if someone has access to the box it is no longer your box.