# Does a "commutative" asymmetric system exist?

Completely crypto noob here.

I'm looking for a cryptosystem made of a func f + key1 + key2 such that they satisfy:

• g(f(msg, key1),key2)=msg
• g(f(msg, key2),key1)=msg
• key1 != key2

Does such a cryptosystem exist?

Ideally I'd like f and g, to be the same function, but I'm ok if they are different.

It is ok if it's not Fort Knox secure, I want it to play with my nephews but I don't mind going hardcore :)

• Normally commutative encryption means that you can decrypt in either order if you encrypt, not that encrypting with one key is equivalent to encrypting with another. Could you clarify what you really mean? Your current equations are fulfilled by e.g. textbook RSA encryption (key1 is the private and key2 the public key), but for real commutative encryption I would look into ElGamal.
– otus
Jan 11, 2016 at 19:31
• That's why I asked about a "commutative" :) What I want to be commutative are the keys. Such if I encrypt with key1, I can only decrypt with key2; AND if I encrypt with key2, I can only decrypt with key1.
– Yolo
Jan 11, 2016 at 19:51
• This question may be interesting for you as the scheme proposed there would satisfy your needs as far as I can tell. Jan 11, 2016 at 20:29

RSA with random exponents would fulfill your key-swapping requirement. I.e. RSA where you generate one exponent randomly and then compute the other from it normally, with neither exponent made public. The operation to encrypt and decrypt is the same (modular exponentiation).

The security of this scheme, or some uses of it is considered in the (currently unanswered) question: Could this "symmetric RSA" scheme provide key compromise resistant communications?

Since you say you do not need it to be extremely secure, it should fit your bill regardless.