I'm no crypto expert but I'm trying to figure out if this is possible:
- I'm building an application that has access to very sensitive user data.
- I receive this data in plain text but I'm not allowed to persist it in this state.
- When I receive data for user X, I must immediately encrypt the data using the key of user X. I can then persist the encrypted data.
- User X needs to be able to grant the ability to decrypt their data to any other user in the system, for a defined period of time. All users in the system are trusted i.e. their identity is not in question.
- The ability to decrypt user X's data can only be gained via user X explicitly granting permission i.e. even system admins should not be able to decrypt user X's data without permission being granted.
But, the most important part of all this is:
- User X should be able to recover their key if they lose it. We can assume that I will have a solid multi-factor authentication flow to establish and verify the identity of user X.
So my questions are:
- If a user loses their key, is there a way to recover their key without having to regenerate the key? So unlike the usual password-recovery flow, I'm not looking to simply regenerate a new key, because that would effectively orphan user X's data already encrypted with the previous key. Is this possible and/or feasible?
- With  in mind, if an attacker gained full access to my database, is it possible to avoid keeping all the user keys in a central location that would expose me to this kind of attack?
- How would I handle providing the ability to decrypt data to an arbitrary number of users without having to re-encrypt the data for each user? i.e. I will only ever have a single encrypted version of user X's data.
I hope this makes sense. I'm happy to try to provide a better explanation.
This answer feels very close, but I'm not sure it satisfies all my requirements: https://mathoverflow.net/a/62111
Any advice and/or guidance would be most welcome.