I understand that multi sig transactions exist so that X of N need to sign to release a transaction. If only 1 of N is required I guess any of the recipients can spend.

This made me wonder, is it possible to encrypt something, so that any one of a set of people can decrypt the data?

I suppose the data could be in the exponent or something, but also possibly going beyond bitcoin, would it be possible to do this with multiple Mb worth of data (stored off chain in this case)? I guess it would require some sort of script that means conditions have to be met to decrypt the data.

  • 1
    $\begingroup$ This is nothing to do with bitcoin. Many general purpose public-key encryption tools allow you to encrypt a document once so that any of several recipients can decrypt the document. $\endgroup$ Commented Oct 22, 2020 at 15:44

1 Answer 1


Sure. First of all, to encrypt a large amount of data you just require a single secret key. So now we've reduced the problem to a single small key instead of a large swath of data. Let's call this key the data key.

Now the easiest way of encrypting for multiple parties is for each party to send you their specific public key. Then you encrypt the data key with each public key and include the results with the ciphertext. This will increase your ciphertext of course, but you should be able to limit to N times the size of the encrypted data key.

There are also schemes such as Shamir's secret sharing where you can do M out of N encryption / decryption.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.