0
$\begingroup$

Is there such a encryption and decryption mechanism: Given an encryption C = E(K1, M), where K1 is the encryption key and M is plain text, it have to apply decryption with two keys K2 and K3 sequentially to recover M, that is D(K3, D(K2, C)) = M. Given a K1, it is ideal to generate unlimited number of pairs K2 and K3 to ensure distributed trust. The encryption and decryption shall not be too slow for larger amounts of data, thus symmetric cipher is preferred.

Alternatively, is there a way to generate three random number sequences R1(K1), R2(K2), R3(K3) from three keys/seeds K1, K2, K3 such that R1(K1) = R2(K2) XOR R3 (K3)? If so, the above problem can be solved too.

I am aware of Threshold ElGamal or other public key cryptography for multi-party cryptography, but they are too slow, comparing to symmetric cyber such as RC4.

$\endgroup$
3
  • 3
    $\begingroup$ Do you require asymmetric encryption, that is K1 public? Can we assume a trusted authority for the making and distribution of K1/K2/K3? Is there any reason why the requirement "encryption and decryption shall not be too slow for larger amounts of data" could not be solved the usual way: by using a random message-unique key to encipher the bulk of the data using a standard fast (authenticated) cipher like AES-GCM; and the multiple-keys thing with K1/K2/K3 (asymmetric or not) protecting the message-unique key? $\endgroup$
    – fgrieu
    Sep 9 at 2:58
  • $\begingroup$ Here K1, K2 and K3 are all secrets. Basically the user 1 encrypt data to E(K1, M), then the decryption shall be done by two parties sequentially D(K3, D(K2, C)) = M. We do not want user 2 see the plain text, and doo not want user 3 to know K1. Here we assume user 2 and 3 do not collude. For public key crypto, my understanding is that it is too slow for large amount of data, right? If it is wrong, we can consider public crypto. $\endgroup$
    – William
    Sep 10 at 13:01
  • $\begingroup$ "For public key crypto, my understanding is that it is too slow for large amount of data, right?". It is generally possible to use a hybrid cryptosystem even when threshold encryption needs to be utilized, that's what fgrieu hinted at (just injecting some terms here :) ) $\endgroup$
    – Maarten Bodewes
    Sep 15 at 8:11
0
$\begingroup$

Alternatively, is there a way to generate three random number sequences R1, R2, R3 from three keys K1, K2, K3 such that R1 XOR R2 XOR R3 = 0?

That part's easy; we can just define:

$$R1 = \text{SHAKE}(K1) \oplus \text{SHAKE}(K2)$$ $$R2 = \text{SHAKE}(K3) \oplus \text{SHAKE}(K1)$$ $$R3 = \text{SHAKE}(K2) \oplus \text{SHAKE}(K3)$$

(where $\text{SHAKE}$ can be, for example, the extensible output function; that is, a function that converts a preimage into an arbitrary length bitstring).

Individually (and pairwise), $R1, R2, R3$ all look random (assuming the keys can't be guessed), however they mutually xor to 0 as you requested.

$\endgroup$
1
  • $\begingroup$ Nice, but user 1 wants to keep K1 secret and not give to user 2 or 3. $\endgroup$
    – William
    Sep 10 at 13:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.