This question already has an answer here:

Is there a asymmetric encryption scheme that allows for multiple private decryption keys?

where m= plaintext message and c= cyphertext message

c = Ek(m) where K is the public encryption key.


m = Dj(c) where J is the private decryption key.

nothing out of the ordinary here, RSA satisfies this basic scenario.

In addition I also want the message to be decrypted by any number of additional keys, ( Dj1 ... Djn ) such that:


m = Djn(c)

does such a scheme exist?

note: I am NOT referring to the way GPG/PGP broadcasts a message to many parties.

edit: looks to be similar to One Encryption, Many Decryption Keys

in particular see D.W.'s answer https://crypto.stackexchange.com/a/39403/29315


marked as duplicate by e-sushi Dec 2 '17 at 19:46


  • $\begingroup$ If it is symmetric, then the holder of $k_1$ could also encrypt any message that the other $k, k_2, ..., k_n$ holders can decrypt. If this is what you're thinking about, then any symmetric cipher would satisfy this requirement where $k = k_x$ for $1\leq x \leq n$. What's the point of such a scheme? $\endgroup$ – Artjom B. Dec 2 '17 at 9:50
  • $\begingroup$ good question. It would provide traitor tracing. So for instance I encrypt with said scheme and produce K1,...,Kn keys. I encrypt those using recipients public keys. Each one now has knowledge of only one K. One person decides to break the secrecy and reveal the signed authorized document by revealing the key. The secrecy is broken but, I know who broke it. That's very useful to me, I can't prevent people from revealing the image of the document, but I can disincentivize them from sharing the signed document. $\endgroup$ – Joshua Zeidner Dec 2 '17 at 9:56
  • $\begingroup$ and I think you may not understand the OP. A typical symmetric scheme has key K and that is used to encrypt/decrypt however what I need is set of keys K1... Kn that can be used interchangeably. It's somewhat similar to Shamir Secrets however I don't need users to collaborate to unlock a secret. Metaphorically it would be like having a lock that can be unlocked by several keys. If someone copied the key, I know who is the culprit by looking at the key. $\endgroup$ – Joshua Zeidner Dec 2 '17 at 10:05
  • 1
    $\begingroup$ just came across this: crypto.stackexchange.com/a/39403/29315 $\endgroup$ – Joshua Zeidner Dec 2 '17 at 10:26
  • 1
    $\begingroup$ "The key generation algorithm takes as input a security parameter s, a number l of private keys to generate, and a number k which we call the collusion bound. It outputs a public encryption key e and a list of distinct private decryption keys d1, . . . , dl. Any decryption key can be used to decrypt a ciphertext created using the encryption key." exactly what I was looking for. Found in the above link. $\endgroup$ – Joshua Zeidner Dec 2 '17 at 10:34