End to end encryption for files

Question

I need to develop a system where a user can upload a file via browser which encrypts the file and stores it on my server. After the file is uploaded other user can download the file with an iOS or android app and decrypt it to view it. The problem is I shouldn't be able to decrypt the file on my server, because the files are potentially very sensitive. Now, I don't have any real knowledge about encryption and don't know where to start. Do you have any hint what is best practice for this kind of end to end encryption?

I have come up with an idea of how my security scheme should look like.

1. The CMS client logs in and his password is used from now on as upload key (later used)
2. On the CMS side, later app user (potential file receiver) are created, with a login password (for the app) and a download key (later used) to decrypt the downloaded files.
3. The CMS client sends the app users their login password and download key in separate mail (no email)
4. The CMS client uploads a file which gets encrypted with a random key (later used) in the browser and stored on server 1. The random key and the reference to the file are getting encrypted with the upload key and stored on server 2.
5. The CMS client selects app user (one ore more) to view the uploaded files. In this moment, the random key and the file reference (from the 3. step) are getting decrypted with the upload key. This decrypted package gets duplicated and encrypted with the download key of the selected app user (this step is done for every selected app user, therefor we will have multiple packages for every app user)

Is this approach close or am I heading in the wrong direction?

Answer 1

I need to develop a system where a user can upload a file via browser which encrypts the file and stores it on my server. After the file is uploaded other user can download the file with an iOS or android app and decrypt it to view it. The problem is I shouldn't be able to decrypt the file on my server, because the files are potentially very sensitive.

People do this frequently with cloud storage systems like Dropbox: encrypt a file, store it on the host, then decrypt it elsewhere. You can re-use any common, well-tested encryption system (GPG, TrueCrypt, etc.), and to the host it's just an encrypted blob.

If you provide this as a product, you should re-use existing file encryption software, and re-use existing cloud storage systems (S3, for instance, is quite cheap and provides excellent availability and durability guarantees); the only bit you have to do yourself is the UX on top of them.

Answer 2

You will want authenticated encryption. AES-GCM with a key derived from something like PBKDF2 is probably your best bet.

The problem here is that if you don't know crypto well it's easy to shoot yourself in the foot. AES-GCM helps with that a bit but it's not bulletproof.

Publish your encryption scheme so others will be able to review it and confirm it's secure.