How can you design an encrypted storage system, that allows adding and removing users without sharing a common secret and having to re-encrypt everything when a user is removed?

My partial idea is:

Each user has a RSA key pair. Shared folders have an encryption key (EK1), that is encrypted with each user's public key. If a user uploads a file, an HMAC-SHA using EK1 is calculated over the file contents. The file is then encrypted using a random nonce (RN), random key (RK) and AES256-GCM(RN, RK, data). The RK is then encrypted using EK1 and prepended to the encrypted file, together with the RN. The encrypted file is then stored under its HMAC-SHA (this also enables deduplication).

If you remove an user from the shared folder, you can generate a new shared folder encryption key (EK2) and encrypt that new key with the public keys of the remaining users.


If a user tries to upload the same file again, it now has a different HMAC-SHA because of the new EK2 which is different from EK1. And decrypting is now also impossible, as EK1 has been replaced by EK2.


How can you model such a storage system, that enables removing users without re-encrypting everything?

  • $\begingroup$ I hope “HMAC-SHA” is HMAC-SHA2 or KMAC-SHA3. While HMAC-SHA1 isn’t affected by the published collision attacks on SHA1, it effectively means SHA1 should no longer be used for any new development but only for backwards compatibility. If you meant “some generic secure MAC I haven’t chosen yet” the convention would be to just call that function “MAC” $\endgroup$ – rmalayter Dec 11 '17 at 11:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.