This is a real-life encryption problem that came up today, and I haven't been able to determine a solution. In essence:
1. Alice can encrypt payloads using Carol's public* key. 2. Bob cannot encrypt or decrypt messages to/from Carol. 3. Alice cannot deliver messages to Carol without Bob's permission. 4. Bob only gives permission to Alice if he agrees with the content of the payload. * Carol's public key is given only to Alice, and is done so both offline and securely.
The goal is so that neither Alice or Bob can be malicious alone in this scenario. If they collaborate and are malicious to Carol, so be it. We can also add any extra encryption, as long as we don't bend the rules too much, especially with Carol who is an outside entity.
Point 1 is no problem, since Alice has the public Key.
Point 2 is no problem, since only Alice was given the Key.
Point 3 is simple, due to the implementation of a separate communication channel that Bob has with Carol and Alice does not.
Point 4 is where the problem lies.
1. Give Carol's private key to Bob. In doing so, Bob can confirm the message that Alice has created. However, we are unable to get Carol's private key.
2. Give Bob a method of generating Alice's payload from the plaintext, AKA with Carol's public key. This however breaks point 2, since now Bob can generate messages without Alice.
I feel like the solution to the problem will be similar to failed solution #2, with a way of giving Bob both the plain-text and the payload, as well as some sort of supporting document that confirms the two are the same.