Does there exist any asymmetric cryptosystem that has the following properties:
If I know somebody's public key PBK_1 and my own key pair (PVK_2,PBK_2), I can construct a new public key PBK_3 such that:
enc(M,PBK_3) = enc(enc(M,PBK_1),PBK_2)
and PBK_3 has the same space and time cost as PBK_1 and PBK_2, or at least doesn't suffer linear blow-up? Obviously if I can use twice the space and time, I can define PBK_3 = (PBK_1,PBK_2) and so forth.
and (I think this is implied by the above but I'll mention it explicitly) that the plaintext and ciphertext are the same size.
My quick survey of cryptosystems reveals no good candidates. The Niederreiter cryptosystem looks like it could compose public keys, except that they are rectangular matrices n x (n-k) instead of square. RSA looks like it could physically represent the composed key, but offers no way to find it without factoring PBK_1. Others either expanded the ciphertext or couldn't compose keys at all.
