PGP multi-key encryption for large, dynamic groups viewing static documents

Question

Suppose I have N users who should be able to decrypt a subset of documents D₁...D_k. N is very large and users are often being adding and removed so it is impractical to encrypt a given document D_i using all of their public keys.

As I've read, a common solution here is to create a group G with its own key pair, and its public key is used to encrypt the document.

What I can't figure out is how to give all users coming in and out of G the ability to use G's private key without storing it on the server.

I thought about encrypting G's private key with the public key of all its members, but what happens when a new user joins? I feel as though I would need to encrypt the private key again, this time with the new user's public key mixed in, however as the server I no longer have access to the unencrypted private key.

The closest solution I've seen is to create a new key pair for G and re-encrypt D_i, but for a large number of documents this too becomes very impractical.

I should add that the system shouldn't be allowed to decrypt user's documents.

Is there some pattern using PGP (or any other standard really) that can help me out here?

Answer 1

I provided an answer to a similar, but not identical question, here: https://security.stackexchange.com/a/159962/60823

about dealing with this for an email list.

Your specific solution will obviously have to conform to your own, unique, threat model and business requirements, but essentially it will look something like this:

Encrypt D with a one-time, symmetric key (e.g. something like AES-256) cipher. Encrypt that key with the PGP public key(s) of each member of the group G. Add, and remove PGP keys as membership changes.

At least one key (belonging to an admin maintaining the group, or a central identity managing daemon) will have to decrypt the session key (not the whole document though) and re-encrypt it with the newly added public key.

Of course, removing people from the group won't help if they have copied the unencrypted data locally, but that's outside the scope of your question. If you want to "lock them out" assuming they haven't already accessed the plain text, you could re-encrypt D with a new session key, and re-encrypt that to only the remaining current members of the group G. But again, that's no help if the person leaving the group already accessed the plain text.