Content Key Encryption for Multi-User data access

I recently worked out a concept for a use-case, but I'm not sure if my approach is good enough. So I would appreciate feedback and things to look out for, as I'm fairly new to this field.

• A User can create, change, and access data on a server.
• The user can also share it with other users so they have the same rights.
• The data on the server needs to be encrypted

My approach:

• If a user creates new data, it gets encrypted/decrypted by a new randomly generated symmetric key (AES-256) aka the Content Key of the new data.
• For every user password+salt a public and private key (RSA) gets derived:
1. The password+salt is hashed with PBKDF2('sha256', password, salt, iterations=100000).
2. This hash is then used as a seed for a random function, to create the public and private RSA keys (1024 bit) for a user. I have written the key generation in python so e and d get calculated in a deterministic way.
• For every user that should have access to specific data, the content key is encrypted with the user's public key and saved in the user table/DB.
• When a user is logged in, the private key is derived. Then the content keys of a user can be decrypted with the users' private key.
• With the decrypted content key, data can be decrypted, accessed.
• As the encryption is dependent on user passwords, a strong password policy needs to be enforced.

For me, this approach makes perfect sense for this use-case, but I would love to hear feedback! I already implemented a prototype for this concept in Python and it works as it should.

This is for a WebApp, so my thought is to handle all of the cryptographic server-side, as client-side code(JS) is too vulnerable for various attacks. Is this approach correct or is there an even better approach?

• So the private key is derived by putting the password+salt into a hash function. The resulting hash is used as seed for a random function. The public and private key are derived by using this random function, because of the seed its deterministic. So far I had to implement my own RSA Key Generation function, to make it work with a random seed. – MultiUserDude Jul 6 '20 at 11:42
• My decision to keep this serverside is because we are developing a WebApp and as far as Im concerned, its more secure to have encryption/decryption server-side, instead of handling it client-side with JavaScript, because its more vulnerable. Yes the private key is exposed for a very short time. Any idea how to improve this? – MultiUserDude Jul 6 '20 at 11:47
• Now, it is more clear? Do you use the same RSA modulus for each user? – kelalaka Jul 6 '20 at 12:39
• No, I use a different modulus for each user. – MultiUserDude Jul 6 '20 at 13:06