Is encrypting a secret key and being able to decrypt plain text with it possible?

Question

Please forgive me if this is a basic question, I'm in high school so I still don't understand very much.

Let's say there are two servers, each with a set of public and private keys. These denote server one: $PK^1, SK^1$ and server two: $PK^2, SK^2$. Each of the private keys stored on the servers are encrypted with the opposite public key. The private key on server one is encrypted with the public key of server two. The private key on server two is encrypted with the public key of server one.

Data $(D)$ is sent to server one encrypted with $PK^2$. Server one encrypts $D$ with $PK^1$ $D = Enc(PK^1, D)$

$D$ is sent to server two, where $D$ is decrypted so that $D = Dec(SK^2, D)$. This should mean that the data is still encrypted with $PK^1$. Server two sends the data back to server one, where server one gets the plain text by doing $D = Dec(SK^1, D)$.

The benefit of this should be clear, the hosting provider is unable to see either of the private keys, which is a massive benefit to software such as Tor. If a private key of a hidden service is stolen, it is disastrous. This way there is no chance of that happening, unless both of the servers are compromised.

Is encrypting a secret key and being able to decrypt plain text with it possible?

Answer 1

In general, the answer is no.

An asymmetric cryptosystem is one which has the property where a public key and private key can be produced which satisfies:

The public key can encrypt messages, and the private key can decrypt messages.

The private key is computationally hard to recover from the public key.

Any particular message is difficult to recover from just the ciphertext and the public key.

We cannot go from these axioms to the property you have described. (These axioms don't tell you anything about how a given keypair interacts / works with other key pairs)

So now we would have to look at specific cryptosystems. Most cryptosystems have multiple variables in the public key. RSA-CRT has the private key mod each prime. Discrete log systems (typically, there are many exceptions) provide the generator, and the group parameters. So your suggested scheme must be encrypting the private keys element-wise, as you must be able to distinguish between the components.

Lets look at RSA. (not CRT)

Let Server one's original RSA private key (before encryption) be $<d_1>$, and Server two's original private key be $<d_2>$

Your question is then: is the following true $(m^{e_2} \mod n_2)^{d_2^{e_1} \mod n_1} = (m^{e_1} \mod n_1)$

I am stating this without proof (look into modular arithmetic for that), but this will not generally be true due to different modulus being used. To begin with, the former term is defined over n_2, and the latter is defined over n_1. Then the property that $m^{e_2 * d_2} = m \mod n_2$ depends on the modulus being $n_2$. It is not true over other modulii. (Look into Lagrange's Theorem if your not convinced - https://en.wikipedia.org/wiki/Lagrange%27s_theorem_(group_theory)) Your d_2 is taken to a power with an another modulus.

There may exist some cryptosystem where this is possible, but I am not hopeful of it working for any of the common cryptosystems.

To address your suggested use case for Tor, that is not viable. You are gaining no additional protection from a man in the middle, and a server can easily store their private key before encrypting it with another servers public exponent. The alternative would be having pre-encrypted private keys distributed from central authority, but that violates the goal of Tor, and alot of cryptography.