Is there any known and proven algorithm which allows n-of-m keys en/decryption, but doesn't require the keys to be in one location? That is, it allows the plaintext (or ciphertext) to be encrypted (or decrypted) with one part of the secret, then passed on to another party, until n parties processed it.
Practically I'm looking for a solution to secret sharing where nobody is trusted to hold the complete key - even temporarily. It sounds like an area of homomorphic encryption, but I couldn't find any obvious software / papers.
Edit: The scenario here is: 3 parties: plaintext generator, storage service, extractor.
The only allowed operations are:
- generator stores an encrypted message, can encrypt together with storage service
- extractor and storage service together (agreed by offline action) decrypt all messages stored by generator (at this time all messages can be deleted) - extractor learns the plaintext, but storage service must not
Explicitly forbidden scenarios:
- storage service or extractor decrypting, or encrypting messages individually
- storage service cannot learn the plaintext when generator is storing then