# Asymmetric encryption, multiple recipients, traitor must share private key

Is there an asymmetric encryption scheme, or public-key encryption, where multiple recipients can access the data, but in order for one of the recipients to leak the key to the data, they would need to share their private key?

I believe this to be true for most one-to-one public key encryption methods (correct me if I am mistaken). If something is encrypted using a public key, the corresponding private key would need to be shared to decrypt the encrypted data. It could be used to identify the corresponding public key.

However, I am curious whether such guarantees could be made in an asymmetric encryption mechanism with multiple recipients.

An example is GPG with multiple recipients. I believe this is accomplished by encrypting a common synchronous key with each of the public keys specified. So I do not think this could guarantee that the private key would need to be shared to grant permission to decrypt the data to another party since the synchronous key likely could just be shared.

Another example I identified is An efficient public-key traitor tracing scheme but it is not clear to me whether the private key would need to be shared in order to be considered a "traitor".

The use case I see for this is if something of value could be accessed using the private key, then the party holding the private key would be motivated to keep it secret. Of course, it does not guarantee they will, but it will put something at stake.

Formally:

Given $$A, B, C \in \{pub,priv\}$$, a set of functions for encrypting/decrypting data $$x$$ follow $$f_0:x,seed,A_{pub},B_{pub},C_{pub}\rightarrow x_{encrypted}$$ and $$f_1:x_{encrypted}, A_{priv} \lor B_{priv} \lor C_{priv} \rightarrow x$$ then the private key of $$A$$, $$B$$, or $$C$$ would need to be revealed in order for data encrypted by $$f_0$$.

Tying value to the private key and encrypting in this manner strikes me as a useful mechanism for incentivizing the owners of $$A, B, C$$ to keep their private keys private as they do a continuous data broadcast with encrypted data for their eyes only. The parties could just relay the data, but that is another topic for another post. I want to focus on a shared key mechanism that can guarantee a high probability that the raw private key will need to be shared to decrypt the encrypted data broadcast actively.