The use case is analogous to accessing a safe box in a bank. There is a per-user key, unique for each user, either generated by the system or hashed from the user's password. And there is a system-wide, master key for all the users. Both keys are required to be able to decrypt data. What's the best way to implement it?
Multiple encryption. It seems I can follow the recommendation on the Wiki page and use the method described by Bruce Schneier.
Encrypt the per-user key with the master key. Use the encrypted key to encrypt and decrypt.
Concatenate the per-user key with the master key. User the concatenated key to encrypt and decrypt.
Especially 2 and 3 would be simpler than 1. But are they free of flaws? I couldn't find examples of them.