I have a web application where I control the server, however, it should not have any knowledge of secrets that are exchanged between its users. This server holds RSA public keys of each registered user and can be trusted to deliver the correct public keys for each user when asked for them. A user's RSA public key is provided to the server whenever they register with the server. Users belong to "teams" and a user can only join a team by way of invitation from another already registered user that is a member of the team.
Alice is already registered and needs to invite Bob to her team and also deliver a team member secret to Bob. Bob is not registered yet, so Alice cannot ask the server for Bob's public key. Right now I have implemented this type of team member exchange where one user is registered while the other is not yet using a three step process:
- Alice sends a team invitation to Bob.
- Bob accepts the team invitation and registers with the server, providing the server with his public key.
- Alice then asks the server for Bob's public key, encrypts the team secret and sends it to the server for Bob (who is now a member of Alice's team) to download.
Bob can now get the encrypted team secret from the server and decrypt it with his private key.
I am trying to reduce this team secret exchange to only two steps. Often times Alice will forget to come back and perform step 3 and would prefer to send the team secret in a secure way at the time of inviting Bob. This is simple to do if Bob was already registered with the server (the encrypted team secret could just be part of the invitation), but often times Bob is not yet registered.
Is there a way that I can perform this team secret exchange in a secure way using only two steps from the user? The server can be used as an intermediary to facilitate the exchange, but should not be able to read the secret.