Is there an algorithm which allows using multiple keys for decryption? I had this scenario in mind: think about being a boss of a corperation which has an encrypted data base with loads of secret files. and you only want to allow employees access to the specific files they need to work with, would it be possible to give them keys to only a specific part of the encrypted data (while as the boss, holding a sort of master key to be able to read all)?
$\begingroup$
$\endgroup$
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
2
It is possible to encrypt a file to multiple users by using CMS Envelope Data.
Firstly, you generate a content encryption key(CEK) to use in file encryption. Then the content-encryption key is encrypted for each recipient. Then store the encrypted data and the encrypted CEKs in an Enveloped Data format. To decrypt a file each client should first decrypt the CEK then use that CEK to decrypt the content itself.
In your scenario you should encrypt each file for the users that you want them to open, and you should encrypt all files for your master user.
-
$\begingroup$ Since there's only one CEK per content item, if a user decrypts the CEK and gets it in his possession (reads from local RAM etc) there's no way to revoke his access to that content going forward except to re-encrypt the content and generate a new CEK, right? $\endgroup$ Commented Nov 1, 2018 at 2:11
-
1$\begingroup$ @RyanGriggs You are right. I can't think of any other way than generating a new CEK and encrypting that new CEK for the remaining authorized people (and also encrypting the file with the new CEK). $\endgroup$– MakifCommented Nov 1, 2018 at 12:10