Ensuring integrity in a multi-user secret vault

Question

Assume you have a vault containing secrets. Each one is encrypted for at least one authorized recipient using some public key crypto (one file per secret). Each authorzied recipient can decrypt all of those secrets. This implies that each recipient can also add additional recipients by decrypting all secrets and encrypting them again for the previous recipients and additionally the new one.

(The details of the encryption don't really matter here, for simplicity sake assume PGP/GnuPG is used.)

While this approach works well for authentication and confidentially, we have a problem with integrity. Malroy could easily add a malicious secret (i.e. a specially crafted phishing link) by encrypting this secret for all the indented recipients.

We could solve this by signing each secret or some kind of digest over the vault, but then we have to figure out who is authorized to sign a secret or the hash? How can we protect the integrity of our vault while still maintaining the ability to add recipients (authorized user)?

Answer 1

Malroy could easily add a malicious secret (i.e. a specially crafted phishing link) by encrypting this secret for all the indented recipients.

Asssume Mallory is also a regular user of the vault. Then if Mallory deposits any malicious information by himself (regardless if it is original or tries to fake some other content), that is impossible to prevent (and doesn't fall under the purview of integrity).

Integrity means, that Mallory can't just change the information placed by Alice - and everyone still thinks the information was put there by Alice. And to achieve that goal it is enough using digital signatures. And of course, everyone can only sign his own secrets.

About the adding of recipients: You said you didn't care about the encryption method, but that actually does matter. Usually you would use hybrid encryption for this kind of storage:

• Encrypt the data itself with a symmetric cipher and a random key (one for each file).
• Encrypt that key with the public keys of the recipients and send it to them (or make otherwise available).

So adding new recipients is simply encrypting the random key with their public key. And to get the integrity:

• Alice signs the encrypted data (symmetric encryption with random key, without the encryption of that key under some public key - that would be user-dependent) with her own signing key.

You have the assumption that every user has a pair of private/public key for encryption, and users know the public keys of others (to make information available). It's not that much of a stretch to also have a signing and verification key for each user.