# Encryption with 2 symmetric keys and decryption with one key

Here is my use case: I need to keep encrypted data in Hadoop. The data is encrypted with symmetric key that is being changed every half a year. When data is retrieved it should be decrypted.

Lets say that data from 1/1/19 until 6/30/19 is encrypted with key1, and data from 7/1/19 until 12/31/19 is encrypted with key2. The issue is that if I retrieve data from 5/30/19 to 7/30/19 I need to decrypt half of the data with key1 and half of the data with key2.

So I am looking for a solution that, for any query with a year time range, will enable to decrypt with a single key.

One solution I was thinking of is to encrypt the data with 2 keys (key1 AND key2) and decrypt it with any of the keys (key1 OR key2). Is is possible?

• I don't believe what you're looking for exists. By definition symmetric encryption means the same key is used for decryption as was used for encryption. Why can't you just select the key to use based on the date the data was encrypted??? Mar 23, 2020 at 15:11
• Since data is retrieved in bulks I'll need to split the result by dates and decrypt each part separately. Also, when the data is queried by an encrypted field, I'll need to split the query by date, encrypt the queried value with the corresponding key, run several queries to get all data and merge the results. I am looking for a way to avoid this complexity.
– JimA
Mar 24, 2020 at 14:27

The immediately obvious way is, when you want to encrypt a record $$M$$, you select a random key $$r$$, and generate $$Encr_{key1}(r), Encr_{key2}(r), Encr_r(M)$$
The decryption process is obvious, using the $$key_i$$ you have, you recover $$r$$, and then use that key to decrypt the actual record.
• @JimA: $r = Hash( key1, key2 )$ works and should be secure.. Mar 24, 2020 at 15:11