I wonder if there is any scheme or algorithm to generate HMACs that verify with multiple keys.
Suppose I have the secret keys K1, K2 and K3 and I have a message M1. Is the following possible?
Generate an HMAC1 with M1 that can be verified with K1 and K2 but not with K3
Generate a HMAC2 with M1 that can be verified with K2 and K3 but no longer with K1
Generate an HMAC3 with M1 that that can be verified with only K1 but not with K2 and K3
That is, to be able to authenticate a message to an arbitrary set of N keys. Maybe not with HMAC but with some other type of MAC algorithm.
I am analyzing if it is possible to issue OTPs (a truncated HMAC) against a series of devices (each one knows its key but not the key of the other devices) that authenticates a user only in an arbitrary subset of these devices.