I have an hybrid encryption (RSA, AES) for a file sharing project I am working on, where I use a single public key for encryption on the sender side and corresponding private key for decryption on the recipient side. I would like for a sender to be able to send files to multiple users each having only their own unique key pair (public keys would be distributed).

I know this is possible using GPG

gpg --encrypt --recipient alice@example.com --recipient bob@example.com doc.txt

How to do this using RSA or ECC? Is it possible?

  • $\begingroup$ Common way is share the symmetric key where the file is encrypted with AES, ChaCha20 etc. $\endgroup$
    – kelalaka
    Nov 3 '21 at 23:53
  • 3
    $\begingroup$ Why not check out the way that the OpenPGP protocol does these things? Undoubtedly they encrypt one or more message specific secret keys using the various public keys of the receivers, and then include the key ID so that the receivers can use the correct private key to decrypt that secret key. The secret key is then used to encrypt / decrypt the actual data (i.e. it is a hybrid cryptosystem where the secret key is encrypted multiple times). $\endgroup$
    – Maarten Bodewes
    Nov 4 '21 at 0:31
  • $\begingroup$ Having the asymmetric part once per each public key was the obvious solution, but I didn't like the size complexity O(n). I wondered if somebody here doesn't know a better solution... Something like ring signature but for encryption. I guess I'll have to go through the OpenPGP code to see what they use... $\endgroup$ Nov 4 '21 at 6:09
  • $\begingroup$ @kelalaka that requires a common secret, I do not want that... $\endgroup$ Nov 4 '21 at 6:11
  • $\begingroup$ PGP is an old protocol, don't expect too much from it. Note that e.g. RSA public key operations can be relatively fast, even faster than ECC public key operations, and you can parallelize the operations as well. $\endgroup$
    – Maarten Bodewes
    Nov 4 '21 at 8:34

You are describing the problem of broadcast encryption. This problem was first studied by Fiat and Naor in the aptly named "Broadcast Encryption" paper where they came up with a scheme resilient against $k$ colluding users with roughly $k$ bandwidth cost.

A more efficient scheme using pairing-based cryptography was introduced by Boneh and Gentry in "Collusion Resistant Broadcast Encryption With Short Ciphertexts and Private Keys" which achieves resistance independent of $k$.

  • $\begingroup$ Note that the link to the Boneh / Gentry paper is an unsecured download of the PDF, which may not work in your browser. For chrome you need to copy the link and paste it into the address bar. Daniel, please do provide textual references as links may go dark; not everything is caught by the wayback machine. $\endgroup$
    – Maarten Bodewes
    Nov 4 '21 at 9:57
  • $\begingroup$ That's what I was looking for, thanks a lot. $\endgroup$ Nov 4 '21 at 12:18
  • $\begingroup$ @Maarten Thanks for the tips and the edits. Is there anything like a cryptoSE style guide that I can read for things like this? $\endgroup$
    – Daniel S
    Nov 4 '21 at 15:00

Not the answer you're looking for? Browse other questions tagged or ask your own question.