1

I have an hybrid encryption (RSA, AES) for a file sharing project I am working on, where I use a single public key for encryption on the sender side and corresponding private key for decryption on the recipient side. I would like for a sender to be able to send files to multiple users each having only their own unique key pair (public keys would be distributed).

I know this is possible using GPG

gpg --encrypt --recipient [email protected] --recipient [email protected] doc.txt

How to do this using RSA or ECC? Is it possible?

J.Valášek
  • 13
  • 3
  • Common way is share the symmetric key where the file is encrypted with AES, ChaCha20 etc. – kelalaka Nov 03 '21 at 23:53
  • 3
    Why not check out the way that the OpenPGP protocol does these things? Undoubtedly they encrypt one or more message specific secret keys using the various public keys of the receivers, and then include the key ID so that the receivers can use the correct private key to decrypt that secret key. The secret key is then used to encrypt / decrypt the actual data (i.e. it is a hybrid cryptosystem where the secret key is encrypted multiple times). – Maarten Bodewes Nov 04 '21 at 00:31
  • Having the asymmetric part once per each public key was the obvious solution, but I didn't like the size complexity O(n). I wondered if somebody here doesn't know a better solution... Something like ring signature but for encryption. I guess I'll have to go through the OpenPGP code to see what they use... – J.Valášek Nov 04 '21 at 06:09
  • @kelalaka that requires a common secret, I do not want that... – J.Valášek Nov 04 '21 at 06:11
  • PGP is an old protocol, don't expect too much from it. Note that e.g. RSA public key operations can be relatively fast, even faster than ECC public key operations, and you can parallelize the operations as well. – Maarten Bodewes Nov 04 '21 at 08:34
  • Why does each key have to be different? What would go wrong if every user had the same key? – kelalaka Nov 04 '21 at 09:26
  • @MaartenBodewes good to know. I expected ECC to be faster. That saves me some troubles as I am using different libraries on different platforms and sometimes it's not straight forward making them encrypt the same way. – J.Valášek Nov 04 '21 at 12:26
  • @kelalaka There are advantages of asymmetric encryption, that I want to have. Having only one key I couldn't control access rights to individual files and/or I would have to create a secure key distribution scheme. In the end, it would be senselessly more complex. – J.Valášek Nov 04 '21 at 12:34

1 Answers1

1

You are describing the problem of broadcast encryption. This problem was first studied by Fiat and Naor in the aptly named "Broadcast Encryption" paper where they came up with a scheme resilient against $k$ colluding users with roughly $k$ bandwidth cost.

A more efficient scheme using pairing-based cryptography was introduced by Boneh and Gentry in "Collusion Resistant Broadcast Encryption With Short Ciphertexts and Private Keys" which achieves resistance independent of $k$.

Maarten Bodewes
  • 92,551
  • 13
  • 161
  • 313
Daniel S
  • 23,716
  • 1
  • 29
  • 67
  • Note that the link to the Boneh / Gentry paper is an unsecured download of the PDF, which may not work in your browser. For chrome you need to copy the link and paste it into the address bar. Daniel, please do provide textual references as links may go dark; not everything is caught by the wayback machine. – Maarten Bodewes Nov 04 '21 at 09:57
  • That's what I was looking for, thanks a lot. – J.Valášek Nov 04 '21 at 12:18
  • @Maarten Thanks for the tips and the edits. Is there anything like a cryptoSE style guide that I can read for things like this? – Daniel S Nov 04 '21 at 15:00