# Encryption that could have multiple decryption key

The title looks strange but it is to deal with this situation.

The data we have should only be accessible by our end user and data administrators, not anyone else. Ideally, each user should have different encryption key.

Even with administrators, I wish only when two of them agrees, then they could access the data by join two pieces of the key. I could think of doing this by breaking up the key into two half, and each one of them holds half the key.

Is there such a cryptography can achieve this? So the file could be decrypted by more than one key. Or any other recommendations?

## migrated from security.stackexchange.comJan 23 '16 at 14:31

This question came from our site for information security professionals.

• Is the number of administrators few enough that the ciphertext length can be linear in that number? ​ Would it be a problem if a malicious encryptor could make it so that some pairs of administrators will get the data and others will discover that the ciphertext was ill-formed? ​ ​ ​ ​ – user991 Jan 23 '16 at 14:15
• What about asymmetric encryption were every user gets its own keypair? – Yorick de Wid Jan 23 '16 at 14:18
• @YorickdeWid Yes, but then the admin couldn't access the data, right? – user469652 Jan 25 '16 at 21:10

Let's assume you have a document DATA you want to encrypt. You first randomly generate a symmetric key K and authenticate and encrypt DATA using this one.
In the next step you asymmetrically encrypt K with the end user's public key and store the resulting cipher text along with the encrypted data.
1. Secretely share a private key among the administrators using a threshold of $k=2$ and encrypt K using the corresponding public key. The drawback of this one is, that the admins actually learn the private key and nothing can stop them from decrypting all files without per-file collaboration of two admins.
2. Give each administrator a private key and secretely share a symmetric key (with a threshold $k=2$) that can recover K (on a per-file basis). Encrypt the shares using the admins' keys and store them with the encrypted DATA and when they need to access a file, they first have to recover the symmetric key using secret sharing and then they recover K. The advantage here is that for each file two administrators have to collaborate but the drawback is that you now need to store $n$ ($n$ being the number of admins) asymmetrically encrypted cipher texts instead of $1$.