Iam not sure if this is the right place but lets see.
Iam developing an system to send private messages from one user to an other use. Under the hood runs PHP 5.2.x .
Now iam looking for any way to crypt private messages in a way that i cant access them. In the moment i have no idea how to realize such a system, where iam not knowing the encryption key.
My first idea was to combine it with something like OAuth.
Some more requirements to clarify the problem:
what about RSA and other public-key cryptography? http://en.wikipedia.org/wiki/Public-key_cryptography
You could use the Diffie-Hellman protocol to generate encryption keys that are only known to the users.
But as a user, you have to have access to those keys in order to read your messages. So you'd have to find a way to store the key at the client instead of your server, otherwise you'd still be able to decrypt the messages. This would be quite a challenge for a PHP site, so I doubt it can be accomplished.
it will never work if you're doing the decryption on your server. You need to do the decryption completely on client side with javascript.
Ideas for looking for information on javascript crypto engines:
If your users all use modern browsers with support for client side database storegae, you can use this to store the keys: an example
you should know, that it would be not very secure if you want the de-/en-cryption to be fast, or it will be really slow, because javascript is not the best language to do crypto stuff.