My question is based on the following situation:
Bob and Alice work for a company that expects them to exchange data encrypted. They could do so using regular public-key cryptography, but Joe (their boss) wants to be part of the procedure to ensure nothing is encrypted or decrypted without his knowledge. Therefore, Joe wants to use his own key as an (let's just call it) "control-key" like this:
- When Alice wants to send Bob an encrypted message, she has to use Bob's public key and Joe’s key to encrypt message to Bob. On the other side, Bob can not decrypt the message using his private key alone… he also needs Joe’s key too to do that.
- Same the other way around: when Bob wants to send Alice an encrypted message, he has to use Alice's public key and Joe’s key to encrypt message to Alice. On the other side, Alice can not decrypt the message using her private key alone… she also needs Joe’s key too to do that.
- Joe himself doesn't care if he can encrypt or decrypt anything using his key alone. He simply wants his key to be part of the procedure (read: cryptographic calculations) whenever Bob or Alice want to exchange data using their public and private keys, so that - without Joe's key ontop of it - encryption and decryption will merely produce garbage.
I am aware that I could try to create a crypto-strategy that might work around some problems to achieve something like this. One way would be splitting the problem by "combining cryptos",using a simple crypto for Joe's key to pre-encrypt and post-decrypt the data AND a public-key crypto for Alice and Bob. But that somehow feels like "rolling my own crypto" and that's the last thing I would like to end up with, so…
Does any public key crypto support and/or allow a 3rd party "control-key" like Joe's?
- While it initially seemed to be a hint towards a potential solution, I don't think "Shamir's Secret Sharing Scheme" or the newer DFT-based (Discrete Fourier Transform) "Threshold Secret Sharing Schemes" will be of any help here after diving into related papers from 1979 to today. To be more exact, I have some security considerations related to schemes based on Shamir's Scheme after reading papers like "On Cheating Immune Secret Sharing" (http://www.dmtcs.org/dmtcs-ojs/index.php/dmtcs/article/download/189/582). Sure, I could work around pitfalls of original weaknesses and - when done - combine it with something like AES, but that would pretty much be "rolling my own crypto-remix". Also, I don't want Alice or Bob to know or to influence each-others keys (or - in Shamir's case - "secrets"). That's why I asked for options based on public-key crypto.
As some comments show my question isn't quickly understood, let me try to explain the model a bit different: think of it as your average public-key crypto... with the exception that not 2 parties, but 3 parties are involved with their public/private key-set.
Theoretically, what I'm looking for would go like this:
- Alice sends Bob some Crypto Data. To encrypt that data, Alice uses both Bob’s public key and Joe’s public key. As a result, the Crypto-Data can only be decrypted using both Bob’s and Joe’s private key, as the encryption procedure used Alice's and Joe's public keys.
- Alice receives some Crypto Data from Bob. To decrypt that data, Alice uses her own private key and she needs Joe to enter/provide his private key “on location”. The Crypto-Data can only be decrypted using both Alice’s and Joe’s private keys, as the encryption procedure used Alice's and Joe's public keys.
As for parts of the comments asking for the infosec part of the model (like safeguarding against the use of subliminal channels etc.)… I regarded that to be a bit out of scope of crypto.SE and I want to prevent the question to become too broad. Therefore, I am assuming (for simplicity's sake) that Joe can make sure that he controls Bob, Alice, or both during either the encryption and/or decryption procedure and is able to make sure his key is used together with another one (either Bob's or Alice's, depending on which side needs it for encryption and/or decryption). I see no need to make things more complicated as I can always start to worry about infosec attack vectors and individual implementation issues arising out of individual circumstances at a later time. Currently, I need to know if such a crypto exists in the first place!