I want to work on a photo-sharing tool, where I can:

  • store photos on untrustworthy disk space (like the cloud)
  • share photo albums with friends and family
  • update photo albums (rarely but happens)
  • share an existing album with additional people

One problem that comes up is:

  • if the photos are encrypted client-side, it usually means only I have the key
  • which means other people could download, but not decrypt the file

Is there a good solution around that problem, where different users could collaborate on collections of files, while files stay encrypted on disk ?


  • I'm aware of this question, but I'm looking for cryptographic techniques, rather than ready made tools.
  • I want any server component to be optional, so that this app is p2p-first. Cloud storage would be optional too, serving as a backup target. That means there would probably not be any centrally managed user database.

2 Answers 2


The typical way of sharing the same file securely with multiple recipients is as follows:

  1. First, the sender generates a random symmetric encryption key, and uses the key to encrypt the file using symmetric encryption.

  2. For each recipient, the sender encrypts the symmetric key using the recipient's public key. The sender sends the encrypted symmetric key to the recipient, along with a link to where the recipient can download the encrypted file.

  3. The recipient downloads the encrypted file, and decrypts the symmetric key using his/her private key. Then, the recipient uses the symmetric key to decrypt the file.

Using this method, the file is encrypted only once, as opposed to encrypting the file for each recipient.

  • 1
    This is exactly what I needed. Thanks ! Commented Jul 28, 2021 at 17:33
  • 1
    This method is vulnerable to MiTM attacks. Commented Jul 28, 2021 at 17:35
  • 1
    An attack (done by a malicious server for example) similar to this will break the whole method. Commented Jul 28, 2021 at 17:38
  • 1
    Yes, like any system built on public key encryption (including Signal), the sender must have a way to authenticate the recipient's public key. This can be done using a PKI model with certificate authorities (as is done on the web with SSL/TLS), or a web of trust model (as is used with GPG/PGP), a trust on first use (TOFU) model (as is used with SSH), or an out-of-band model (as Signal uses).
    – mti2935
    Commented Jul 28, 2021 at 17:39
  • 1
    @MohamedWaleed I agree, Signal (and it's related protocols) are superior to this. This is basically similar to PGP/GPG, where a user uses the same keypair for years. But, it is vulnerable if the private key is compromised.
    – mti2935
    Commented Jul 28, 2021 at 19:27

You can check the Signal Protocol

This protocol is mainly used to transfer end-to-end encrypted data.

The protocol mainly consists of:

1) X3DH (Extended Triple Diffie-Hellman) key agreement protocol

X3DH establishes a shared secret key between two parties who mutually authenticate each other based on public keys. X3DH provides forward secrecy and cryptographic deniability.

2) The Double Ratchet Algorithm

the Double Ratchet algorithm, which is used by two parties to exchange encrypted messages based on a shared secret key. The parties derive new keys for every Double Ratchet message so that earlier keys cannot be calculated from later ones. The parties also send Diffie-Hellman public values attached to their messages. The results of Diffie-Hellman calculations are mixed into the derived keys so that later keys cannot be calculated from earlier ones. These properties give some protection to earlier or later encrypted messages in case of a compromise of a party's keys.

By using Signal Protocol, you can transfer safely any kind of traffic between some parties and even you can't see the photos your users are sharing using your tool.
Also Signal Protocol is not vulnerable to MiTM attacks as long as the users are mindful with the chat code (known as Safety number in Signal and security code in whatsapp) that is generated after doing the X3DH handshake (you will know about it from a video in the resources down below).

About managing file encryption keys:

you can use a zero knowledge authentican protocol to authenticate your users, by this you can't know what passwords are the users using. So you can (in the client-side) use the password of the account of the user (if you have an account system) to derive from it an encryption key to encrypt the encryption keys of the encrypted photos to be stored safely in the cloud, so you won't worry about how to manage encryption keys in the client-side.

Note: if the user forgot his password the encryption keys cannot be recovered.

Other useful resources:

  1. This video will help you understand more about end-to-end encryption
  2. This video will help you understand X3DH key agreement protocol
  3. This video will help you understand the Double Ratchet algorithm
  4. This video will help you understand how to share end-to-end encrypted data between more than two parties
  5. This video will help you understand more about zero knowledge authentication

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .