I want to build an app where users upload files and admins review these files. But the owners of the server should never be able to have access to any data from the files, only encrypted content. The users should only be able to see the files they uploaded, and the admins should see all the files.
If I had to implement it myself, I would do something like:
- admin would be regular "users" from the point of view of the storage system, with which all users automatically share read access to their files.
- symmetric encryption for the files using a random key per file (or per user because I don't need per file access control). The random key is then asymmetrically encrypted (one time for each person needing access to the file, in my case one for the user and one for each admin) and stored along the file on the server
- Users have a password from which you derive their private/public key pair (the key pair could be directly derived from the password (but when the password changes you have to re encrypt all the symmetric keys for this user), or preferably encrypted using the password and stored on the server (so that when the password changes, you only re encrypt the private key).
- The user password hash (not the password itself) is also used as an authentication password to avoid having multiple passwords but also to avoid sending the user password to the server (the server then normally computes and compares the salted hash of this hash of the password)
Are there open source solutions (libraries, servers with http APIs, etc.) that can be easily used to implement a custom app like this ?
I found https://www.minio.io/features.html, an http server with s3 compatible rest APIs which has "Both server side and client side encryption are supported" but couldn't find more documentation on the client side encryption.