I would like to know the practical limitations to contact chaining multiple peoples pgp key's in order to protect a file.

In normal public key cryptography, four keys are required, public and private from both parties. But, if the integrity of one of participants is compromised say, through torture or some other form of coercion the information may as well be in plaintext.

However, what if that burden was lightened by having cryptography that required multiple keys from different individuals in order to encrypt and could be decrypted, using the public keys from those individuals. That way, it might be akin to having 2 or more deadbolts on a door that a thief would have to mitigate. I'm not talking here about encrypting a file that has already been encrypted, but using a combination of keys in order to encrypt a file that could then be decrypted only by having the public keys of everyone who did the initial encryption.

I'm sure there are a few needless redundancies or other things I'm not taking into account in this plan. What are they?

  • K, let me try to explain it this way, since I already have smoke coming out of my ears. Amy and Bob want to get Dick on board with their group, because they think Dick shares the same philosophical ideals concerning free software. Carol is of course, a disgusting, crafty brownshirt who has been tasked with not letting this happen. Amy and Bob have a piece of software that will help Dick evade Carol's immoral trickery. But, Dick might be more sure that the software he downloaded hasn't been compromised, much less the writers of the software, if Amy and Bob were both to sign off on it.
    – user117619
    Commented Jul 25, 2015 at 18:25

3 Answers 3


Out of the box with GnuPG/PGP, there is no way to encrypt a file with the method you suggest. There is a "group" encryption or ability to encrypt to multiple recipients, but that allows each recipient to individually decrypt the message rather than rely on anyone else's key.

What you can do, and is commonly done, is to split the PGP private key and require multiple individuals to come together and make the key whole in order to decrypt the message. Also, instead of individuals, you can have the other part of the key be on a hardware security module, smart card, or other such device.

You might want to take a look at SplitGpg which seems to do what you are asking.

  • What is OP asking for is an "and" on private keys. What GnuPG easily provides is an "or" on private keys.
    – dan
    Commented Jul 24, 2015 at 20:14
  • Yes. Is there something unclear about how I phrased that information in the first paragraph? Commented Jul 24, 2015 at 20:17
  • 1
    On the contrary, your answer is absolutly clear.
    – dan
    Commented Jul 24, 2015 at 20:25
  • I'm thinking that SplitPGP was the kind of thing I was looking for. Thank you for the suggestion!
    – user117619
    Commented Jul 25, 2015 at 18:28

OpenPGP actually defines (or at least indicates) a way to do so, RFC 4880, Key Flags knows the option flag 0x10:

   0x10 - The private component of this key may have been split
          by a secret-sharing mechanism.

To do so, you'd have to split up the key on your own and put things together again. An easy way might be to separate "physical" ownership of the symmetrically encrypted key (ie. the private key encrypted with a passphrase), and knowledge of the passphrase itself. There are more complex scenarios for secret sharing you could apply on the exported key. SplitGpg (as proposed by @Herringbone_Cat) seems to implement such an algorithm, but I've never tried it.

  • Thank you @Jens Erat, the article on secret sharing talked about many of the concepts I was thinking of, but lacking the vocabulary to explain.
    – user117619
    Commented Jul 25, 2015 at 17:18

You could literally chain the encryption by double-encrypting the file:

cat FILE |gpg -er [email protected] |gpg -er [email protected] > FILE.alice+bob.gpg.gpg

This would require Bob to decrypt FILE.alice+bob.gpg.gpg into FILE.alice+bob.gpg, which then requires Alice to decrypt. Alice won't be able to do anything with the double-encrypted file and Bob wouldn't be able to do anything with the single-encrypted file.

Using group encryption would allow for more stability, so you could encrypt to a whole group instead of just Alice, then encrypt to another whole group instead of just Bob (decrypting requires only one member of each group). You could even choose to have a more privileged user be in both groups (and therefore be able to decrypt both layers).

A weakness of this system is that only Bob (or any member of the outermost group) can verify the integrity of the inner level of encryption. There's also a bit of overhead given the doubled metadata.

In this regard, Herringbone_Cat's answer of using SplitGpg may be preferable, but I'm unsure about the security ramifications of literally splitting a single key (it assumes each part is robust). Certainly, if you choose this path, multiply the key size by (at least) the number of times you intend to split it so you can minimize the chance that a key part owner can brute-force guess the remaining part(s).

Also ensure that you never send any private key part over the internet without encryption (perhaps encrypt each key part to each party's personal PGP key).

  • Once again, I apologize if I don't have the proper terminology at my immediate disposal. What I originally meant by chaining the private keys was to make one large key, in this case 8192 bits as opposed to making a 4096 bit one out of multiple peoples 2048 bit half keys. I'm having difficulty understanding whether a single public key could be made out of the 8192 bit private key, that Dick could then decrypt using his private key. Or, do all public and private keys need to be the same size in order for the concept to be feasible?
    – user117619
    Commented Jul 25, 2015 at 18:43
  • That is not possible. SpligGpg and similar mechanisms would have one public key and a bunch of people with (arguably yet not provenly useless) partial private keys. Double encrypting would have two public keys and a bunch of people with the ability to only decode one half of the encryption. If you have untrusted users performing the double encryption, you cannot actually verify there is an inner layer. If that's your intent, use SplitGpg.
    – Adam Katz
    Commented Jul 25, 2015 at 19:45
  • 1
    Correction: double encrypting would require all public keys (one per member of each group). This would be cumbersome for a human to do. Coupled with the fact that you can't verify the inner encryption without decrypting the outer layer, this is only feasible if you have a dedicated system (not a person) performing the encryption.
    – Adam Katz
    Commented Jul 25, 2015 at 19:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .