I am working on application that allows users to upload files
containing company data and then share those files with a list
of other users that have specific roles within the system. I
want to encrypt the uploaded files to protect the data at rest
while allowing the files to be shared by people who do not know
the encryption password. The uploaded files are owned by the
company that they belong too not by the user who uploads them. -
When a user creates an account on the system a private-public
key pair is generated for the user, the private key is stored in
the database and is encrypted with the users clear text
password, which is accessible during the login process. User
passwords are salted, , stretched hashes so other than during
login the app does not know the clear text of the users
password. - When a user log's into the system successfully the
encrypted user's private key is pulled from the database,
decrypted and the private decrypted key is stored in the http
session. I am assuming that while the de