GnuGP 多密钥加密的可扩展性问题
我想跟进此处发布的问题：
我我已经为我构建的 Web 应用程序实现了 GnuGP 解决方案，但我很快就遇到了可扩展性问题，我不得不承认我有点陷入困境。基本上，您确实可以使用多个公钥加密一个文件，以便所有这些人都可以解密该文件。伟大的。但现在想象一下您与 100 个人共享此文件，您该怎么做？
我遇到的第一个限制是命令行限制，我不能在一行中输入 100 个公钥。
第二个限制是每次我想添加新人或撤销对某人的访问权限时，我都必须使用以下命令重新加密101 或 99 键非常省时且方便。消耗CPU。
第三个限制更糟糕，假设我正在共享一个文件夹，每个访问该文件夹的新人都需要与该文件夹的每个文件的所有人重新加密..
所有这一切看起来都非常肮脏/黑客..任何人有更好的解决方案吗？
谢谢
I want to follow up on the questions posted here:
Encryption with multiple different keys?
I've implemented the GnuGP solution for a web app I built but I fell into scalability issues pretty quickly and I have to admit I have been a bit stuck. Basically, it is true that you can encrypt a file with multiple public keys so all those people can decrypt the file. Great. But now imagine you share this file with 100 people, how do you do that?
The first limit I've encountered is the command line limit, where I cannot put in one line 100 public keys..
The second limit is everytime I want to add a new person or revoke access to someone, I have to re-encrypt with the 101 or 99 keys which is very time & CPU consuming.
The Third limit is even worse, let's say I'm sharing a folder, every new person getting access to the folder requires the re-encryption with ALL people of each file of the folder..
All this seems very dirty/hacky.. Anyone would have a better solution?
Thanks
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
为每个文件夹创建一个随机 AES 密钥，并使用它来加密文件，例如使用 AES EAX。然后使用您想要授予访问权限的人员的公钥加密该密钥。如果您稍后添加一个人，请使用“admin”私钥解密，然后简单地使用公钥加密私钥。您可以使用文件名的哈希值（例如 SHA-256）作为 EAX 密码的初始计数器。
至于命令行工具，您最好对这些东西进行编程（例如，使用 GnuPG 本身用于 C/C++ 和相关工具，以及用于 Java 应用程序的 Bouncy Castle）。
Create a random AES secret key per folder, and use that to encrypt the files, e.g. using AES EAX. Then encrypt this key using the public keys of the persons you want to give access to. If you add a person later on, decrypt with an "admin" private key, and simply encrypt the secret key with the public key. You can use a hash (e.g. SHA-256) over the filename as the initial counter for the EAX cipher.
As for command line tools, you are better off programming this stuff (using GnuPG itself for C/C++ and related and Bouncy Castle for Java apps, for instance).