I'm developing an intranet for a company where admins are sharing a huge excel file containing all the necessary password, on the common TSE. I've managed making them encrypt it with a common password at least.
I would like to make a "password sharing" system on the intranet, allowing them to store passwords and data encrypted, shareable between them, but obviously, unreadable if it hasn't been shared (even for the db admin).
So, if they used PKI or even knew about it, it would be great. So I'm looking for a way to store encrypted data, which would be decrypted on the fly when a logged in user wants it, but only using common "login" practices if possible (user, password, web browser).
Of course, the server shouldn't be able to decrypt the data alone, it needs something from the logged in user (for instance, deriving the user's password as the users key), so "sharing" a data would only be possible when the data is inserted. For that, I'm can't see how to achieve it without a public part and a private part, which I'm avoiding because they won't take care and will loose them.
It's not the best, but one of my ideas was to create a key-pair (under the hood) for each user stored encrypted using a password derived from the user's credentials. The key-pair and derived password would be stored in expiring cookie (when browser/tab is closed) (decryption will be client side) or more secure, in-memory session files (server side).
What do you think folks ?