Asymmetric Encryption for Multiple Recipients?

Let's assume an arbitrary group of people who hold a key pair and who make their public key online accessible.

Let X, A, B and C be arbitrary people from that group.

Now X wants to encrypt a message once using A's, B's and C's public key so that only A, B and C will be able to decrypt the same ciphertext.

(Think of an encrypted FB/Diaspora where you would like to introduce asymmetric encryption but don't want to encrypt individually for each of your friends. And the content might be stored centralized - such that more people from the total user group have access to the data but shouldn't be able to decrypt it.)

Is that technically possible? If yes, does this asymmetric encryption method already have a name or known implementation?

• Does it need to be infeasible for X to cause A,B,C to not all get the same plaintext? ​ ​
– user49075
Commented Jan 9, 2016 at 13:31
• Not entirely sure if I get the question. The scenario I have in mind could be something like a post on your (FB) wall / timeline which you only want to share with your friends or a sub-group of those. It would be the same plaintext for all of them. Commented Jan 9, 2016 at 13:33
• For the easiest way to get something like what you're asking about (namely, the way described in Steffen's answer), X could trivially cause A and B and C to each get different plain texts from the same ciphertext. ​ Is that a problem? ​ ​ ​ ​
– user49075
Commented Jan 9, 2016 at 13:35
• Not sure if that could cause a problem - but I don't see any until now. Commented Jan 9, 2016 at 13:37

In that case you generate a random symmetric key for each message and use that symmetric key to encrypt the message. Then you encrypt one copy of that symmetric key per recipient with the key of that recipient and attach these to the message. So the message will contain of:

``````symmetric key S encrypted with public key A
symmetric key S encrypted with public key B
symmetric key S encrypted with public key C
plaintext encrypted with symmetric key S
``````

This method is usually referred to as "hybrid encryption" and it is very common because most symmetric encryption and decryption systems are far faster than most asymmetric ones. So encrypting just a symmetric key with the expensive asymmetric algorithm and then using that symmetric key for the bulk of the message has far better performance, even when there is only one recipient.

Another useful side-effect is that it also prevents replay attacks and known-plaintext attacks. When you send the same message to the same recipient multiple times, the cyphertext will always be completely different because the symmetric key will be different. So an eavesdropper can't tell if a message is identical to a previous one. A man-in-the-middle can also not replay a previous message because the recipient could become suspicious if the sender uses the same symmetric key twice.

The usual way this is done in PGP etc is to create a symmetric key and encrypt this key with the public keys of each recipient. The original message itself will be encrypted with the symmetric key. Thus the result includes the encrypted message once (single key for all recipients) and then the encrypted symmetric key (short compared to the message) for each recipient.