Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to encrypt some data so that it can only be read if two or three people use a private secret to decrypt the data.

What is the best / most modern way to accomplish multi-person decryption?

Some thoughts I am thinking of

  • X people has N characters of a password that is X*N characters long

  • Re-encrypt the message with PGP or some PKI/RSA etc

  • A mixture of the above...

The threat I want to prevent against is the forced decryption or modification of an encrypted message without all parties present.

share|improve this question
I am not familar with any encryption schema that requires multiple private keys. The entire point of a public and private key is there is a 1-to-1 connection. Why don't you just encrypt it multiple times with different private keys? – Ramhound Mar 22 '12 at 18:00
@Ramhound - That is my thought, but need to be sure of my approach – LamonteCristo Mar 22 '12 at 18:08
When you write "only be read if two or three people" do you mean that it can be read in situations where three people are given a key, and can be read either if "two of those three keys are provided" and "three of those three keys are provided"? Or are you using "two or three" to mean you want to implement this for some X number of people, where X is a fixed size during the implementation, but can vary for a given scenario? – amccormack Mar 23 '12 at 9:06
@amccormack I'm open to whatever you got. My scenario is that a UN-supported peace program would give two countries the decryption keys to a message. The person who sent the message would know that the message could only be read if more than one delegate decrypted it. I'm open to having all keys or a majority set opt into decrypting the message. – LamonteCristo Mar 23 '12 at 17:06
A similar question was asked on crypto.SE a while back, – mikeazo Mar 23 '12 at 17:14
up vote 6 down vote accepted

There's Shamir's secret sharing, but it doesn't involve PKI. Rather, it's more like ensuring that all passwords need to be involved in order to unlock the secret. The secret, in this case, could be a singular (private or symmetric) key.

I don't know of any widely accepted implementation of the scheme aside from the top few hits you get from Google.

share|improve this answer

Short Answer
Use the XOR of multiple keys as the actual encryption key. Give each of those keys to the parties. To decrypt they each must reveal their key, XOR all values together, decrypt.

Long Answer

  • X people has N characters of a password that is X*N characters long

The problem with this scheme is that if X-1 people come together, they only need to brute force N characters (the last portion of the share). Depending on your parameters, this could be achievable.

What you really want is a method where if less than X people try to decrypt, they have no additional information about the secret encryption key. An easy way to achieve this would be to give each of the X parties an X*N character string which is completely random. Then set the secret encryption key to the XOR of these strings. If X-1 parties try to decrypt, they will have to brute force an X*N character random string which would be infeasible if you set the parameters correctly (say X*N is 128 bits long and use AES-128 for encryption).

  • Re-encrypt the message with PGP or some PKI/RSA etc

PKI should never be used for bulk encryption (encrypting a long message). PKI is typically used (in this scenario) to distribute a key.

Now, say you modify this to instead use PKI to distribute X secret keys of length X*N (same as above). Then you send out C=E(K1, E(K2, E(...E(Kn, M)))). This would work, but the computational overhead is pretty big if n is large. For 2 or 3 parties this would probably be fine.

Threshold Decryption

The above is only valid if you require that all X people be present to decrypt. What if you only wanted it such that t out of X are required. This is when you could use Shamir Secret Sharing (see logicalscope's answer).

Note that Shamir Secret Sharing will work if t==X, but is not as simple as the method I outlined.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.