# Multiuser encryption, singleuser decryption [duplicate]

I have an hybrid encryption (RSA, AES) for a file sharing project I am working on, where I use a single public key for encryption on the sender side and corresponding private key for decryption on the recipient side. I would like for a sender to be able to send files to multiple users each having only their own unique key pair (public keys would be distributed).

I know this is possible using GPG

gpg --encrypt --recipient alice@example.com --recipient bob@example.com doc.txt


How to do this using RSA or ECC? Is it possible?

• Common way is share the symmetric key where the file is encrypted with AES, ChaCha20 etc. Nov 3 '21 at 23:53
• Why not check out the way that the OpenPGP protocol does these things? Undoubtedly they encrypt one or more message specific secret keys using the various public keys of the receivers, and then include the key ID so that the receivers can use the correct private key to decrypt that secret key. The secret key is then used to encrypt / decrypt the actual data (i.e. it is a hybrid cryptosystem where the secret key is encrypted multiple times). Nov 4 '21 at 0:31
• Having the asymmetric part once per each public key was the obvious solution, but I didn't like the size complexity O(n). I wondered if somebody here doesn't know a better solution... Something like ring signature but for encryption. I guess I'll have to go through the OpenPGP code to see what they use... Nov 4 '21 at 6:09
• @kelalaka that requires a common secret, I do not want that... Nov 4 '21 at 6:11
• PGP is an old protocol, don't expect too much from it. Note that e.g. RSA public key operations can be relatively fast, even faster than ECC public key operations, and you can parallelize the operations as well. Nov 4 '21 at 8:34

You are describing the problem of broadcast encryption. This problem was first studied by Fiat and Naor in the aptly named "Broadcast Encryption" paper where they came up with a scheme resilient against $$k$$ colluding users with roughly $$k$$ bandwidth cost.
A more efficient scheme using pairing-based cryptography was introduced by Boneh and Gentry in "Collusion Resistant Broadcast Encryption With Short Ciphertexts and Private Keys" which achieves resistance independent of $$k$$.