# Can “PrivateKey+MagicValue” decode pre-encoded data without intermediate key?

Let's say I want to build a public repository of encrypted files.

• EncA(FileA)
• EncB(FileB)
• EncC(FileC)

And I have users with Public/Private key pairs.

• PubX/PrivX
• PubY/PrivY
• PubZ/PrivZ

Now I want to give individual users permanent access to individual files by handing them some special MagicKey that is only for them. However, I don't want them to be able to share FilaA with third parties except by sharing FileA directly (or by also sharing their private key).

i.e.: decrypt(PubX, MagicKey(PubX, EncAPars), EncA(FileA)) yields FileA, but with no intermediate result that can directly decrypt EncA(FileA).

A close solution I was thinking about is:

• EncA is AES
• PubX/PrivX is RSA

with

 EncA(FileA) = aesEncrypt(aesKeyA, FileA)
MagicKey(PubX, aesKeyA) = rsaEncrypt(PubX, aesKeyA)
decrypt(PrivX, MagicKey(PubX, aesKeyA), Enc(FileA)) = aesDecrypt(rsaDecrypt(PrivX, MagicKey(PubX, aesKeyA)), EncA(FileA))


but this does not do what I want, because UserX could just share the AES key with third parties who download EncA(FileA) from my repository and then decrypt directly.

• One practical problem you're likely to face is that, even if there was a scheme that could do what you want, it would likely be a lot less efficient than the standard hybrid encryption solution that you've already rejected as unsuitable. All the efficient schemes I'm aware of for public-key encryption of bulk data use a symmetric cipher to do the actual data encryption, and thus suffer from the same issue that revealing the symmetric key will let anyone decrypt the data. – Ilmari Karonen Sep 25 '16 at 21:09
• Did you have a look at Proxy Re-encryption? IIRC these schemes require a key for the proxy to translate messages from one encryption to another (but I don't know whether this key can be (made) message-specific...) – SEJPM Sep 25 '16 at 21:34