Multiple Keys for an Encrypted Secret

Question

I have the following problem:
I want to put a document on a ipfs store. So it is accessible via a distributed network.
Now, at first only two persons (Alice & Bob) should have access on the file. So I need to encrypt it and give them a private key. But I don't want that both have the same private key, because when one of both shares the key with someone else, probably the other doesn't want this. If the private key is unique I always know, who has shared the key.
But later it should also be possible to share the document with other persons if both agree. But then also these others should get their own unique private key(s) to decrypt the file.

The following text should describe the scenario:

Alice and Bob have a secret. Both have a different key for decryption of the secret.

Later Cesar gets a copy of the secret from Alice. Alice gives Cesar an additional private key to decrypt the secret. Now we have three private keys for decrypting the secret.

Later Jack gets a copy of the secret from Bob with an additional private key. Again different from the others.

Would something like this be possible in any way?

Answer 1

Here is one possibility, which answers the scenario you asked about, but feels too fragile for real use.

We'll have a trusted dealer, which selects an RSA modulus N (with secret factorization), a large exponent $e$, and two decryption exponents $d_1 = e^{-1} \bmod \lambda(N) + k_1 \lambda(N)$ and $d_2 = e^{-1} \bmod \lambda(N) + k_2 \lambda(N)$, for distinct integers $k_1, k_2$ (and $\lambda(N) = \text{lcm}(p-1, q-1)$)

Then, he encrypts the secret using RSA and exponent $e$; he then hands $d_1$ and $N$ to Alice, and $d_2$ and $N$ to Bob; they can both use these to decrypt the secret using RSA.

Just given $d_1$ or $d_2$ (and $N$), neither of them can recover the other; hence you have the traitor-tracing properties you're looking for.

Of course, if anyone learns two of $e, d_1, d_2$, they can factor (and so can derive their own $d$ values), hence the fragility of the system I mentioned.

Answer 2

As i don't feel i have a very solid theoretical answer to your specific question, i will leave that for someone else.

However, you might want to take a look at this question on StackOverflow for a more real-world answer, using GPG multi-key encryption.

Another possible approach you might find interesting, is Shamir's Secret Sharing, which should be possible to modify the usage of to match your use case.