How can you design an encrypted storage system, that allows adding and removing users without sharing a common secret and having to re-encrypt everything when a user is removed?
My partial idea is:
Each user has a RSA key pair. Shared folders have an encryption key (EK1), that is encrypted with each user's public key. If a user uploads a file, an HMAC-SHA using EK1 is calculated over the file contents. The file is then encrypted using a random nonce (RN), random key (RK) and AES256-GCM(RN, RK, data). The RK is then encrypted using EK1 and prepended to the encrypted file, together with the RN. The encrypted file is then stored under its HMAC-SHA (this also enables deduplication).
If you remove an user from the shared folder, you can generate a new shared folder encryption key (EK2) and encrypt that new key with the public keys of the remaining users.
If a user tries to upload the same file again, it now has a different HMAC-SHA because of the new EK2 which is different from EK1. And decrypting is now also impossible, as EK1 has been replaced by EK2.
How can you model such a storage system, that enables removing users without re-encrypting everything?