I'm looking for encryption scheme with the following properties:
- There's a sequence of keys that can be used to decrypt the message
- Strictly only one key from the sequence is required to decrypt the message
- Keys need to be used in the order that is defined by keys sequence
- Once used, the key can't be used again to decrypt the message (this implies some kind of transformation of encrypted message as part of the decription process)
- It is not possible to derive keys from the sequence based on knowing any number of the keys from the sequence
- The encrypted message is kept by third party (e.g. on a server), that decrypts it for the receiver of the message on request, but only the receiver of the message keeps the sequence of the keys. In case of security breach, if the encrypted messages leak from the storage they're kept on, they're worthless for the attacker, because the third party doesn't keep the sequence of the keys. I know that it would be still possible to steal the message from primary memory when the receiver decrypts it, but the focus is on making the permanent storage of the message safe.