Multiple private keys

Question

Bear with me, I'm a utter newbie in this field.

I'm looking for a way to tackle this:

Alice and Bob have a secret document. Alice gives Bob a key to secure the document. Bob uses this key to encrypt the secret document. Nobody that finds this key should be able to decrypt the data. Alice holds a special key that can decrypt the document.

Some time passes and Bob needs to read the document again. Alice gives Bob the special key to decrypt the data.

So in this scenario, once the document is encrypted only Alice has control over when Bob can read the document with her special key. We assume that the key Bob used to encrypt the document can stolen or found. So the key to encrypt the document can not be used to decrypt it. Only Alice her special key can. So this means: use a public key to encrypt and a private key to decrypt the document. So my research points me to for example: RSA.

Now let's make it a bit more complex and closer to our real scenario:

Alice and Bob have a secret document. Alice gives Bob a key to secure the document. Bob uses this key to encrypt the secret document.

Alice and Cesar have a secret document. Alice gives Cesar the same key as Bob to secure the document. Cesar uses this key to encrypt the secret document. Nobody that finds this key should be able to decrypt the data. Alice holds a special key that can decrypt the document.

Some time passes and Bob and Cesar need to read the document again. Alice gives Bob and Cesar each a different special key decrypt the data.

So this is sorta the same as before. Only this time we use multiple private keys and one public key. My first option was RSA but since RSA can only have 1 private key, what are my options?

Answer 1

You can use different key pairs for this. You can give both Bob and Cesar two public keys that they can use to encrypt documents with. Those public keys are part of a key pair that is shared with Bob and Cesar - one for Bob and one for Cesar.

Bob or Cesar encrypt the document by first encrypting a two random symmetric keys with the public keys (one each) and using the result of XOR-ing the two random values as another symmetric (data) key. Then either of them needs to encrypt the document with the symmetric data key. To decrypt they both need to decrypt both symmetric keys, combine them and then decrypt the document. They can do this in any order, as long as the two symmetric keys become available at the same time.

This is a fairly basic secret sharing scheme with an asymmetric component.

---

Undoubtedly there are better schemes that have additional properties. Having some kind of signing or authentication should be high on your wish list as well.