Suppose that we have three authorities which each of them generate one secret/public key for Alice. It means that Alice has three secret keys and three related public keys. Suppose that Alice combines these three secret keys in a way with any kind of function and generate a new secret key (forth secret key), can he generate the related forth public key by any function or not? Is there any relationship between these two functions?
What's asked is possible, both for public-key encryption and signature schemes.
One option can be a concatenation of the keys, with delimiters allowing separation of concatenated keys (by the same function for public and private keys), with
- for encryption, cascaded encryption in order of the public keys
- for decryption, cascaded decryption in reverse order of the private keys
- for signature (with appendix), concatenation of the signatures in the order of the private keys, with delimiters allowing separation of the signatures
- for signature verification, verification of all the signatures in the order of the public keys (and success iff all the signatures check).
More in details, restricting to public-key encryption: we start from some hybrid public-key encryption scheme, easily implemented with wrapper scripts on top of GPG. Encryption accepts any plaintext file and a public key (as a text file starting with
-----BEGIN PGP PUBLIC KEY BLOCK----- restricted to a single such block), and outputs a ciphertext file. Decryption accepts a ciphertext file and the matching private key (as a text file starting with
-----BEGIN PGP PRIVATE KEY BLOCK----- restricted to a single such block), and outputs the original plaintext.
We define the question's functions building new keys to both be concatenation: the "fourth secret key" is the file obtained by concatenation of the first three secret keys (with some EOLs as separator), same for the public keys.
We modify the encryption script to parse its public key input and, for each public key found in that, encrypt the plaintext (for the first key) or the previous encryption result (for the next ones, if any). It outputs the final ciphertext obtained.
We modify the decryption script in the same way, except that it processes multiple private keys starting from the last one in the private key input file.
The modified encryption and decryption scripts still works just as the original when fed a single public or private key. And when using the fourth public and private keys as obtained by the concatenation functions, they are able to encrypt and decrypt.
It can be proven that if GPG is secure, then the new scheme obtained is.