Utilizing encryption key exchange and rotation to share passwords via a shared folder

1. A non-transitory computer readable storage medium comprising instructions that, when executed by at least one processor, cause a content management system to:

provide, to an initial client device of a plurality of client devices associated with a shared folder of the content management system, a public key set comprising one or more public encryption keys associated with one or more additional client devices of the plurality of client devices;

receive, from the initial client device for storage within the shared folder, an encrypted payload comprising a set of passwords and a shared encryption key that is utilized to encrypt the set of passwords and is encrypted in the shared folder utilizing the public key set;

detect a key rotation event for replacing the shared encryption key with a modified shared encryption key;

provide an updated public key set to one or more client devices of the plurality of client devices in response to the key rotation event; and

receive, from an initiator device of the one or more client devices and for storage within the shared folder, an updated encrypted payload comprising the set of passwords and the modified shared encryption key that is utilized to re-encrypt the set of passwords and is encrypted in the shared folder utilizing the updated public key set.

2. The non-transitory computer readable storage medium as recited in claim 1 , further comprising instructions that, when executed by the at least one processor, cause the content management system to retrieve the public key set by:

determining an account of the content management system according to a sharing membership for the shared folder; and

requesting a public encryption key for a registered client device associated with the account of the content management system.

3. The non-transitory computer readable storage medium as recited in claim 1 , further comprising instructions that, when executed by the at least one processor, cause the content management system to receive a request to generate the shared folder for the set of passwords by:

determining a set of password permissions associated with the set of passwords; and

generating a folder structure for the shared folder with access permissions to one or more folders corresponding to the set of password permissions within the folder structure.

4. The non-transitory computer readable storage medium as recited in claim 1 , further comprising instructions that, when executed by the at least one processor, cause the content management system to receive the encrypted payload by receiving, as part of the encrypted payload, the shared encryption key encrypted utilizing the one or more public encryption keys associated with the one or more additional client devices.

5. The non-transitory computer readable storage medium as recited in claim 1 , further comprising instructions that, when executed by the at least one processor, cause the content management system to:

determine that a new client device associated with an account of the content management system is added to a sharing membership for the shared folder;

provide, to the initial client device, a new public encryption key associated with the new client device;

receive, from the initial client device, the shared encryption key encrypted in the shared folder utilizing the new public encryption key; and

provide, to the new client device, the encrypted payload comprising the set of passwords and the shared encryption key encrypted in the shared folder utilizing the new public encryption key.

6. The non-transitory computer readable storage medium as recited in claim 1 , further comprising instructions that, when executed by the at least one processor, cause the content management system to provide the updated public key set to the one or more client devices of the plurality of client devices by:

in response to the key rotation event, sending an indication of the key rotation event to a one or more client devices having current membership access to the shared folder;

retrieving the updated public key set from the one or more client devices having current membership access to the shared folder; and

providing the updated public key set to the one or more client devices having current membership access to the shared folder.

7. The non-transitory computer readable storage medium as recited in claim 6 , further comprising instructions that, when executed by the at least one processor, cause the content management system to detect the key rotation event by:

detecting a change in a sharing membership for the shared folder;

receiving a command from a client device of the plurality of client devices to change the shared encryption key; or

detecting a time threshold associated with the shared folder.

8. The non-transitory computer readable storage medium as recited in claim 6 , further comprising instructions that, when executed by the at least one processor, cause the content management system to:

receive the updated encrypted payload for upload to the shared folder from a first client device of the plurality of client devices before or without receiving the updated encrypted payload a second client device of the plurality of client devices;

in response to receiving the updated encrypted payload from the first client device before or without receiving the updated encrypted payload from the second client device, determine that the first client device is the initiator device and the second client device is a follower device; and

send the updated encrypted payload comprising the set of passwords and the modified shared encryption key to the second client device.

9. The non-transitory computer readable storage medium as recited in claim 8 , further comprising instructions that, when executed by the at least one processor, cause the content management system to:

receive, prior to sending the updated encrypted payload to the second client device, an additional modified shared encryption key from the second client device;

detect a conflict between the modified shared encryption key received from the first client device and the additional modified shared encryption key received from the second client device; and

reject the additional modified shared encryption key received from the second client device in response to detecting the conflict.

10. A system comprising:

at least one processor; and

a non-transitory computer readable storage medium comprising instructions that, when executed by the at least one processor, cause the system to:

provide, to an initial client device of a plurality of client devices associated with a shared folder of a content management system, a public key set comprising one or more public encryption keys associated with one or more additional client devices of the plurality of client devices; and

receive, from the initial client device for storage within the shared folder, an encrypted payload comprising a set of passwords and a shared encryption key that is utilized to encrypt the set of passwords and is encrypted in the shared folder utilizing the public key set;

detect a key rotation event for replacing the shared encryption key with a modified shared encryption key;

provide an updated public key set to one or more client devices of the plurality of client devices in response to the key rotation event; and

receive, from an initiator device of the one or more client devices and for storage within the shared folder, an updated encrypted payload comprising the set of passwords and the modified shared encryption key that is utilized to re-encrypt the set of passwords and is encrypted in the shared folder utilizing the updated public key set.

11. The system as recited in claim 10 , further comprising instructions that, when executed by the at least one processor, cause the system to:

retrieve the public key set by requesting a public encryption key for a registered client device associated with a sharing membership for the shared folder; and

provide the public key set to the initial client device by providing, as part of the public key set, the public encryption key from the registered client device to the initial client device to cause the initial client device to encrypt the shared encryption key utilizing the public key set including the public encryption key from the registered client device.

12. The system as recited in claim 10 , further comprising instructions that, when executed by the at least one processor, cause the system to receive a request to generate the shared folder for the set of passwords by:

determining a hierarchy of folders within the shared folder; and

determining access permissions for each folder in the hierarchy of folders according to password permissions for a sharing membership for the shared folder.

13. The system as recited in claim 12 , further comprising instructions that, when executed by the at least one processor, cause the system to:

assign, to a first account of the content management system, a first set of access permissions for a first set of folders corresponding to a first set of passwords within the hierarchy of folders; and

assign, to a second account of the content management system, a second set of access permissions for a second set of folders corresponding to a second set of passwords within the hierarchy of folders.

14. The system as recited in claim 10 , further comprising instructions that, when executed by the at least one processor, cause the system to:

detect a change in a sharing membership for the shared folder;

in response to the detected change in the sharing membership:

determine an updated sharing membership for the shared folder including a plurality of accounts of the content management system corresponding to the one or more client devices of the plurality of client devices; and

send an indication of a key rotation event to the one or more client devices of the plurality of client devices;

retrieve a plurality of public encryption keys from the one or more client devices of the plurality of client devices; and

provide the updated public key set comprising the plurality of public encryption keys to the one or more client devices of the plurality of client devices.

15. The system as recited in claim 14 , further comprising instructions that, when executed by the at least one processor, cause the system to:

receive an additional modified shared encryption key from a follower device of the one or more client devices of the plurality of client devices after receiving the updated encrypted payload from the initiator device;

in response to detecting a conflict between the modified shared encryption key received from the initiator device and the additional modified shared encryption key from the follower device, reject the additional modified shared encryption key received from the follower device; and

send the updated encrypted payload comprising the set of passwords and the modified shared encryption key received from the initiator device to the follower device.

16. The system as recited in claim 10 , further comprising instructions that, when executed by the at least one processor, cause the system to:

receive the shared encryption key encrypted by the one or more public encryption keys associated with the one or more additional client devices; and

provide the shared encryption key encrypted by the one or more public encryption keys to the one or more additional client devices with the set of passwords encrypted utilizing the shared encryption key.

17. A method comprising:

providing, to an initial client device of a plurality of client devices associated with a shared folder of a content management system, a public key set comprising one or more public encryption keys associated with one or more additional client devices of the plurality of client devices;

receiving, from the initial client device for storage within the shared folder, an encrypted payload comprising a set of passwords and a shared encryption key that is utilized to encrypt the set of passwords and is encrypted in the shared folder utilizing the public key set;

detecting a key rotation event for replacing the shared encryption key with a modified shared encryption key;

providing an updated public key set to one or more client devices of the plurality of client devices in response to the key rotation event; and

receiving, from an initiator device of the one or more client devices and for storage within the shared folder, an updated encrypted payload comprising the set of passwords and the modified shared encryption key that is utilized to re-encrypt the set of passwords and is encrypted in the shared folder utilizing the updated public key set.

18. The method as recited in claim 17 , wherein:

retrieving the public key set comprises:

requesting a first public encryption key from a first client device associated with a first account of the content management system; and

requesting a second public encryption key from a second client device associated with a second account of the content management system; and

wherein providing the public key set to the initial client device comprises providing, as part of the public key set, the first public encryption key and the second public encryption key to the initial client device.

19. The method as recited in claim 17 , further comprising:

in response to the key rotation event:

determining an updated sharing membership for the shared folder; and

sending an indication of the key rotation event to the one or more client devices of the plurality of client devices based on the updated sharing membership;

retrieving the updated public key set from the one or more client devices of the plurality of client devices; and

providing the updated public key set to the one or more client devices of the plurality of client devices according to the updated sharing membership.

20. The method as recited in claim 19 , wherein detecting the key rotation event for changing the shared encryption key comprises:

detecting a change in a sharing membership for the shared folder;

receiving a command from a client device of the plurality of client devices to change the shared encryption key; or

detecting a time threshold associated with the shared folder.