I'm working on an app where I want to provide end to end encryption on files, where multiple users are able to access these folders. I'd like the encryption to be as transparent and frictionless as possible (I don't want users to have to manage their own keys), so I've been considering ways to do this.
The requirements for this protocol are:
- Users do not have to manage their own key
- Users must be able to use it from multiple devices
- On changing device, users must still have access to their old files
My current thoughts are:
- When a user signs up, generate a keypair (client side)
- Encrypt their private key with a symmetric key derived from salt + password (client side)
- Upload public key, encrypted private key,
hash(salt + password)and salt to API
- Server side, store public key and encrypted private key. As the users password is used for encrypting their private key, it cannot be transmitted in plaintext to the server, ever. If, instead, a hash is transmitted, their password is not revealed but if an attacker were to breach the database, it would be possible to use the hash to login to their account, but not decrypt files. To fix this, the password hash transmitted is rehashed server-side, and stored.
- When a user creates a folder, generate a new symmetric key, and encrypt these files using that key (client side)
- Encrypt this symmetric key using the users public key (client side)
- When user logs in, download their public and encrypted private key
- Decrypt private key, store on device
- Use private key to decrypt symmetric key, then decrypt files
- To grant folder access owned by A to another user B, user A fetches the public key for user B from the API, decrypts the folder symmetric key using their own private key, then encrypts the symmetric key again using B's public key, before transmitting it back to the API. User B can then fetch the encrypted symmetric key, decrypt it using their private key, and decrypt the folder contents
Does such an approach make sense (from a security and usability perspective)? Are there any caveats or potential pitfalls?
I understand that there are N times protocols for multi-party asymmetrical encryption, however as it's files rather than messages being stored it's not realistic from a bandwidth perspective.