I am building a system where the clients should be able to communicate with each other. However I want all the data to be hidden from the server where the information is stored in a database.
How can the users invite more users and share the encryption key without that the server also get the key?
- First user creates a key (locally on the device) to encrypt the messages (symmetric encryption).
- First user invites another user. How can the key be distributed from the first user to the second user without that the server also get this information? Same question goes for user three etc.
- The idea is that the second user, after accepting invite, can read all the data that the first user have created and that now user two and three can create new data that user one can read.
- I don't want the users having to enter passwords or such things.
- The clients cannot communicate directly with each other, it has to go through the server.
I suppose that when the key has been distributed it's quite easy to just store that on the clients and then the key can be used to both decrypt and encrypt the messages. If a client loses the key I suppose that that user needs a new invite to be able to read the data again. For this system it is not required that the key needs to be changed if someone leaves the group.