I realize SIMILAR questions have been asked before but I'm looking for certain specifics I can't seem to find elsewhere. The following question closely resembles mine but falls short for me on details: Encryption strategies for multi users access in production systems.
I'm creating an application that allows users to add content, which is then encrypted and stored in a database using a content key. This content key is a randomly generated string of 32 characters (since rijndael-256 doesn't seem to support more than 32 characters, or certain utf-8 characters for that matter, but that subject is outside the scope of this question). The content key is also stored in the database, encrypted with the private application key.
What doesn't make sense to me is that next, according to similar posts, each user that should have access to the encrypted content should be given a unique key.
How is this safer than let's say creating a reference for every encrypted row stating which users are allowed to view the encrypted content based on the user's id?
What I'm looking for is a detailed explanation on how to tackle these kind of situations, and furthermore what the keys and passwords (if any) should be derived of.