I am working on an app that has to transfer sensitive data over HTTPS and I have an idea but I am wondering if it is overkill or good.
One of the issues is I need the ability to "share data" between users, so I created the idea of a group.
Each user has a secret key which is stored in their browser (if they want or they can type it out everytime they want to get the data). Each users secret key is immediately encrypted upon entering it using the "code" from the server.
Each user has a "code" which is stored on the server. This is generated on registration. This is used to encrypt the secret key stored in the browser.
Each user can be part of a group, each group has a 256 bit key which is generated on created. All of the groups sensitive data are not encrypted with the users secret key, but the groups key. The each group member has the same key that’s encrypted with that users secret key. So to request group data it sends the users encrypted key to the server, the server sends back the encrypted data (encrypted with the group key AND the encrypted group key) the browser then decrypts the content by using the secret word in the browser to decrypt the group key and then uses the group key to decrypt the data.
Reasoning for all of this.
I want to make sure if the "evil person" has 2 pieces of the puzzle they are still not able to access the data. Say the "evil person" steals the users laptop which has the secret word, and possible data sent. I want to make sure they would still need to login in order to decrypt the data (to get the code which is used to decrypt the secret word). (Maybe this is excessive?)
The rest is just standard encryption stuff. With the addition of the ability to share encrypted stuff among multiple users.