A method of encrypting data to be accessed only by a group of users comprises a user in the group receiving a user secret si=ƒ1(R, ui), the user secret having been created by operating a first one-way function f1 on parameters comprising a root key R and a public identifier ui for the user. The user in the group receives a public identifier ui for each of the other users in the group. The user in the group obtains a group key by operating a second one-way function ƒ2 on parameters comprising the user secret s, and the public identifiers for the other users in the group u1, u2, . . . , uj−1, uj+1 . . . un−1, un, wherein said second one-way function/band said first one-way function ƒ1 satisfy: ƒ2(ƒ1(R,u1), u2, . . . , un)=ƒ2(ƒ1(R,u2), u1, u3, u4 . . . , un)= . . . =ƒ2(ƒ1(R,un), u1, u2 . . . , un−1). The user in the group encrypts the data using the group key.