I have a web app that is storing information related to a organization that I would like to encrypt but share amongst organization members. I would only like the members of the organization to be able to view this encrypted data not server admins.
It seems like I want some form of symmetric encryption. Each member would have a copy of a master secret encrypted using a user provided password. The steps to gain access to the organization data would be, provide user password to get master secret, use master secret to unlock organization data.
One concern I have is adding a new member to the organization. I don't see a obvious way to allow the new member to create their version of the encrypted master secret. Some how when the new user is creating a new account they will need the master secret to encrypt but i'm not sure how to do that in a secure way.
It's also very likely i'm thinking of all of this the wrong way, any advice would be great. Thanks.