I have a web app that is storing information related to a organization that I would like to encrypt but share amongst organization members. I would only like the members of the organization to be able to view this encrypted data not server admins.

It seems like I want some form of symmetric encryption. Each member would have a copy of a master secret encrypted using a user provided password. The steps to gain access to the organization data would be, provide user password to get master secret, use master secret to unlock organization data.

One concern I have is adding a new member to the organization. I don't see a obvious way to allow the new member to create their version of the encrypted master secret. Some how when the new user is creating a new account they will need the master secret to encrypt but i'm not sure how to do that in a secure way.

It's also very likely i'm thinking of all of this the wrong way, any advice would be great. Thanks.

2 Answers 2


Normally in an organization a sysadmin is a guy who everybody trusts.

It seems like I want some form of symmetric encryption

  1. The biggest issue with symmetric encryption will be sharing of the secret key among the members of the organization.
  2. Another issue is even if the secret key is successfully shared but stored in the client system (most lazy people will do it) then the admin can log in to the system and access the key.The key better be kept on a USB drive.

Using a public-private key pair

  1. The use of PKI will definitely protect your data and solve the problem of key-sharing but your question does not mention the number of people who will be accessing the data as well as the amount of data you are willing to share.

  2. Let us say you have 100 users then the server that hosts your data will have to keep track of every single user's public key.

  3. Since you don't trust the admins I suppose the data kept on the server will be encrypted in advance by using every user's public key (so that only he/she can decrypt it). this will mean that there will be 100 different instances of the same set of data. Depending on the size of data and number of users this might be a performance issue.

I would simply suggest maintaining an intranet website with user authentication and HTTPS enabled which will not be under the sysadmins control(if your security policy allows that). But then again you have to take the headache of maintenance and security of the system.

Note: Normally a sysadmin will have physical access to all the systems in an organization and your data will be present in plain text in some place or the other (on client systems who decrypted the data for their use). So there are many ifs and buts....


Standard threat model disclaimer: difficult to answer without knowing more of the context of the system, how sensitive the data is, types of attackers etc.

Assuming the only threat agent you are worried about is a system admin and they full admin rights to the web application, OS and database, keeping information stored in such application and database completely secure from them is almost impossible. E.g. even if you encrypt it at rest, with full OS access they access decryption data in memory.

If they only have application admin access and maybe database admin access and you want to make it more difficult for them to access the data in clear (80/20 rule) then some form of client side encryption would be best. You can use asymmetric encryption to archive this with the data encrypted using multiple user public keys. The private key for each user is stored only locally by the user and used for decryption. There is no key backup and if a user loses their private key, their access gets revoked and a new user account created for them.

This has advantages over the symmetric key method you described because each organization member would not need to know the master key and key distribution is secure.

For example:

High level client side encryption

If you are concerned about database admins only and not application admins a simpler approach is to use something like transparent database encryption which means if they directly access the database they cannot view the information.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .