I was wondering whether there exists a symmetric encryption scheme such that
- there is 1 sender and n receivers. Each receiver has 1 random and independent symmetric key. The sender knows the symmetric keys of all receivers in advance.
- the sender can encrypt one message using the above n keys and produce a ciphertext. Each receiver can decrypt the ciphertext using his own symmetric key to recover the message.
- the above n keys are used only for encrypting/decrypting 1 message.
- the encryption is deterministic. This excludes some trivial constructions such that sampling one shared key that is used for encrypting the message, followed by respectively encrypting the shared key using n symmetric keys.
- the scheme achieves somewhat one-time-CPA security. Of course, compared to the standard notion, the difference is that we need to consider n keys instead of 1 key.
Motivation: Now I am facing one problem that a large file needs to be sent to multiple users (only once) under the condition that the randomness generator of the sender is broken (or unreliable).