Group password creation scheme

Question

PREVIOUS RESEARCH: I have searched for password rulesets/schemes and password sharing, but the articles I have found deal with an individual’s passwords, not a group or team’s passwords.

SCENARIO: I am part of a small work team of about 3 to 4 people. We have sensitive material that occasionally needs to be emailed as an attachment (typically Word documents or PDFs).

I would like to create a password ruleset/scheme for our team that would be applied to the documents that we send. This ruleset should:

• Easily understood (not too complicated/difficult to create the password)
• Password is not easily guessed
• Password is distinct for each document we send
• Easy for each of the team members to figure out (i.e. a team member can guess another team member's document's password)

The last point deserves some more explanation. It would be highly beneficial if the ruleset/scheme allowed for each of the team members to be able to figure out what the password on the document was, even if s/he did not create the password. My idea was to create a password by combining the senders first name, the recipients last name, and the date.

EXAMPLE: If a team member, Bob, needs to send a document to Jim on December 7, 2017, then the password for the file would be “JimBob1272017”. Likewise, if team member Jack needs to send a document to Jill on February 23, 2018, then the password would be “JackJill2232018”. As long as the other team members know the sender, recipient, and date, then they should be able to figure out the password. Thus, if any team member is ill or resigns, then documents are still accessible.

QUESTIONS: Does anyone have suggestions for creating a password ruleset/scheme that meets the four previously mentioned criteria? Or, can someone provide suggestions to improve the process I’ve described?

NOTES: We do keep track of our passwords, but I was thinking this could be helpful if someone forgot to keep track of a password or if a client forgot the document’s password (and the password creator wasn’t available and the password wasn’t recorded properly).

I don’t think it would be wise to make the team repeatedly use one password for every document (e.g. The team uses “password” for each document’s password), nor would it be wise for each team member to use his/her own personal password repeatedly (e.g. Bob uses “password” for all of his documents, but Jack uses “Acme” for all of his documents).

Thanks!

Answer 1

Making different passwords which are easily guessable adds no real security, but it does protect against accidentally reading a document intended for someone else. If that's all you need, great! Just concatenate the recipient name with a strong password known by the team.

But if you want to make it significantly difficult for teammates to snoop in documents not intended for them, I would suggest that you use asymmetric encryption together with secret sharing:

Encrypt each document so that it can be decrypted by either of two keys. The first key is the recipient's private key, and the other is a secret that requires two (or more) team members to uncover using the above-mentioned secret sharing.

This way, only the recipient can read the document, unless two or more team members together decide that they need access to it.

Answer 2

Your scheme is inherently insecure. There is zero entropy present in the password, which is what determines a password's strength. You should expand on your business use cases and requirements - if you truely don't need to have secure documents this is fine, but it's trivial to compromise this type of security. From your requirements -

Easily understood (not too complicated/difficult to create the password) - Good
Password is not easily guessed - Failed, also very important.
Password is distinct for each document we send - Passes.
Easy for each of the team members to figure out (i.e. a team member can guess another team member's document's password) - Not applicable to passwords. If you only need knowledge of how a password is generated to guess it, you have an insecure password. This isn't an appropriate use case for passwords.

A better resolution would be to deploy a secure system such as an SFTP server that can be accessed by customers, clients, and employees. Use role based security to determine who can access what. This is a much better solution than this password scheme.