I have been looking into PGP, but do not want my users to have to worry about securely storing their own private keys. Therefore, I feel like maybe just symmetric encryption without private key would suffice.
What is the recommended way of doing so? Is it to use their passwords somehow? If I said users are tied to a role, and read permissions are based on that role, would it be simpler to just use some sort of shared symmetric key for each role?
Use case: It's transactions on a ledger, where the ledger is public and anyone can see it, but all the transaction information is currently stored in plaintext. I would like the transaction information to be encrypted for the user roles relevant to that type of transaction. Everyone can see that the transaction actually occurred, but the goal is just better security than letting everyone clearly see the full contents of every transaction.
Example: There is a Blue team and a Red team. When a Blue user uses the system, they are able to see a list of all transactions for both parties. This allows them to see that the Red team has indeed been transacting, but because they are not on the Red team and do not know the Red language, they cannot read exactly what was transacted, and only know that it occurred.
- can store keys using cloud key management service
- cannot expect users to manage their own keys with cold storage/paper wallets/etc.
- works quietly under the hood, where users simply login with email and password, and should be able to view decrypted information relevant to their role
- some transactions might be encrypted for multiple roles