Revoke decryption capability

Question

I'm looking for a way to encrypt some data in such a way that I can later revoke a single person's ability to decrypt it.

We have a store of database backups that are currently encrypted using GPG. However to decrypt them the team need the single private key.

Instead, I'm wondering if there's a way to give everyone the ability to decrypt using their own key, but be able to later revoke a single decryption key while still allowing everyone else the ability to still decrypt.

The only option I can think of is to either create a backup per key and then delete the ones for the key I want to revoke. But that means storing a LOT more data than I care to.

Answer 1

The only way to easily accomplish this is to not allow the user to decrypt the file themselves. If you build a system that will handle the decryption and never give the user the actual decryption key, then you can give each user a key that the application uses to decrypt the key used to protect the shared data.

To remove a user, you simply delete the copy of the shared key that is encrypted with their user key. The entire security of such a system depends on their inability to ever actually get at the key used to encrypt the shared data. If they get that key, then it is impossible to prevent them from opening the encrypted file anytime they choose.

Answer 2

In general, it is physically impossible to take away knowledge from someone. When you give someone both the data and the key to decrypt it, there is no way to ever take this information away from them, because they have the ability to create unlimited backups from each which will both work for all eternity.

When you want to be able to control access to knowledge, you need to keep some kind of secret for yourself which you only give to a person when they want to access the knowledge. But considering that your suggestion was to create multiple copies of the data with different keys and destroy those which are revoked, you seem to be aware of this.

In your scenario you can encrypt the data with a common master-key. Then you create a copy of that master key for each user and encrypt each with the users key. When a user needs to decrypt the data, you give them their master-key copy encrypted with their key. They can then decrypt the master-key and use that common master-key to decrypt the data. When you want to revoke access for a user, you destroy the master-key copy encrypted for them.

Keep in mind that after you gave a user a master-key copy, they will forever have access to that master-key. That means you should change the master-key and re-encrypt the data at regular intervals. That way they only have access to the data in the state when they got their key-copy and not have access to a later state of the data because it is encrypted with a different master-key.