Web browser-based secure cryptographic key management

A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device to perform steps of:

• generating, by a web browser, at least one cryptographic key pair based at least in part on a key generation request received at the web browser from a web-based service running on a web server, the key generation request specifying one or more usage rules for the at least one cryptographic key pair;
• providing, from the web browser to the web-based service running on the web server, a public key of the at least one cryptographic key pair;
• maintaining, in secure storage of the at least one processing device accessible to the web browser, a private key of the at least one cryptographic key pair;
• receiving, at the web browser from the web-based service running on the web server, a signature request for signature of one or more messages using the at least one cryptographic key pair;
• verifying, at the web browser, whether the signature request is permitted by the one or more usage rules for the at least one cryptographic key pair specified in the key generation request;
• generating, at the web browser, one or more interface features permitting a given user to accept or deny the request for signature of the one or more messages;
• responsive to the given user accepting the request for signature of at least a given one of the one or more messages, digitally signing the given message utilizing the private key of the at least one cryptographic key pair;
• and
• providing, from the web browser to the web-based service running on the web server, a response comprising the digital signature of the given message.

A method performed by at least one processing device comprising a processor coupled to a memory, the method comprising:

• generating, by a web browser, at least one cryptographic key pair based at least in part on a key generation request received at the web browser from a web-based service running on a web server, the key generation request specifying one or more usage rules for the at least one cryptographic key pair;
• providing, from the web browser to the web-based service running on the web server, a public key of the at least one cryptographic key pair;
• maintaining, in secure storage of the at least one processing device accessible to the web browser, a private key of the at least one cryptographic key pair;
• receiving, at the web browser from the web-based service running on the web server, a signature request for signature of one or more messages using the at least one cryptographic key pair;
• verifying, at the web browser, whether the signature request is permitted by the one or more usage rules for the at least one cryptographic key pair specified in the key generation request;
• generating, at the web browser, one or more interface features permitting a given user to accept or deny the request for signature of the one or more messages;
• responsive to the given user accepting the request for signature of at least a given one of the one or more messages, digitally signing the given message utilizing the private key of the at least one cryptographic key pair;
• and
• providing, from the web browser to the web-based service running on the web server, a response comprising the digital signature of the given message.