keyring encrypted with public keys

Question

I would like to publicly store a list of public keys of recipients in a way that only the individual recipient ( who holds the private key of a that referenced public key) can see that he is referenced in that public key list and preferably not be able to see who else is being referenced. This means the list of recipients has to be encrypted in a way that one of the recipients can determine that the list contains his key.

I thought of signing a random string with public key of someone as a way to mark that he is referenced as a recipient but how can this be done for multiple recipients?

Is this possible and who could this be solved?

Answer 1

Using an elliptic curve:

As the publisher of encrypted public keys, you have the private key $a$, and publish your public key $A=a\cdot G$.

Encrypt and publish each entry $X_i=a\cdot P_i$, where $G$ is a well-known base point on the curve, and $P_i$ is the public key that is stored.

You can decrypt each published encrypted public key by calculating $a^{-1}X_i$, where $a^{-1}$ means the modular multiplicative inverse of $a$.

An individual with key pair $(p_\pi,\ P_\pi=p_\pi\cdot G)$ checks if $p_\pi\cdot A\overset{?}{=} X_i$ for each entry published. If there is a match, then that is an entry for their public key $P_\pi$.

Only the holder of a particular private key will be able to check if an entry corresponds to their public key.