With asymmetric cryptography, you normally encrypt with the public key, not the private key; with the private key, you decrypt. Moreover, asymmetric encryption is usually randomized, so it can be hard to tell that you get "the same result" than what you would have with a single private key, since you can actually get a whole range of values (which would decrypt to the same message, though). Maybe you want to speak about signatures ?
In any case, there are a lot of possible protocols for multiparty computations (that's the term for that kind of things). See this site for a lot of links. In your case, I suppose that you have two parties who need to use a private key so that their combined actions are equivalent in some sense to what could be achieved with a single secret value, that neither knows. Protocols which achieve that depend on the exact extent of the knowledge and action of both parties:
- Are the two key holders considered to be potential active attackers, or only passive ? I.e. do we want to protect the secrecy of the scheme if one of the parties begins to send incorrect, carefully crafted messages to the other ?
- What is the level of control that the key holders have on the input data ? Can they modify it in some way to reveal information about the the other key half ?
- Should each party be able to ascertain that the other party played the protocol faithfully ?
- Should such a proof be discloseable to a third-party without revealing anything about the processed data or the keys ? (This is the kind of proof that is very important in, for instance, e-voting protocols.)
- What can the key holders be allowed to do ? E.g., if they can encrypt, is it OK if they can also decrypt (assuming they collaborate to the task) ?
As an illustrative example, suppose that you have an elliptic curve E with prime order n. Parties A and B knows secret keys a and b respectively; both keys are chosen uniformly in the 1..n-1 range. Suppose that you can map some input message m into a curve point M. Then A may "encrypt" the message by multiplying M with a; similarly, B multiplies points by b. If both A and B process the message in due order:
- A receives M and outputs aM.
- B receives aM and outputs (ba)M.
The final result is then equal to (ab)M, the result of the "encryption" of M by the key ab (product is modulo n), that neither A or B knows. It can be shown that A cannot learn ab regardless of what he sends to B; and the same applies to B if B is the villain. Of course, if A and B reveal their private keys to each other, then they can compute ab.
(This is an elliptic curve variant of the Pohlig-Hellman cipher -- not to be confused with the other Pohlig-Hellman algorithm. It is also known as SRA.)