Question on double-asymmetric encryption and split knowledge

Question

Moin moin,

• Let‘s assume there are two keypairs (d1,e1) and (d2,e2), where d1 and d2 are unrelated private keys and e1 and e2 the corresponding public keys.
• Imagine Alice knowing neither d1 nor d2 and Bob only d1, not d2.
• Alice has a ciphertext c resulting from encrypting a message m with e1 using RSA. She cannot decrypt it because she doesn‘t know d1.
• Alice encrypts c again with e2 using an asymmetric cipher (remains to be chosen) and sends it to Bob.
• Bob can‘t decrypt it since he doesn‘t have d2.
• Can he then use some kind of algorithm and d1 to produce something which he can send to me that can be decrypted with d1 and d2 resulting in the original message?

What I want is, that Alice and Bob cannot read the message, only the combined knowledge of both secret keys would allow them to decipher it.

Pseudocode:

m is the message

c := RSAEncrypt(m, using: e1)

Alice does:

c2 := AsymEncrypt(c, using: e2)

Bob does:

c3 := RSADecryptAlgo(c2, using: d1)

I want to:

m = SomeDecryptionAlgo(c3, using: d2)

Is this scenario (though quite strange) even possible? If so, does anyone know a googleable term or an algorithm/s which would fit my case?

Edit: The keypairs do not share the same modulus

Answer 1

What I want is, that Alice and Bob cannot read the message, only their combined knowledge would allow them to decipher it.

"Committing with partial knowledge of group order" scenario was presented at the CECC 2010.

A scheme was designed such that order of an RSA-like multiplicative group is split into two parts shared by two parties such that both must participate to decrypt. Technically, modulus is a product of four primes, spit into two pairs for each party.

Answer 2

The question is a bit confusing but to me it feels very related to a three-pass protocol. Specifically, we require a "commutative" (order-independent) encryption scheme, where (for all messages), $$c = Enc(k_1, Enc(k_2, m)) = Enc(k_2, Enc(k_1, m)).$$

In this case, the ciphertext $c$ can be decrypted with $k_1$ and $k_2$ in either order to re-obtain $m$.

I believe this is only possible with RSA if both keys use the same modulus. It can also be done with ElGamal (reference) and maybe other schemes too. In any case, it's probably only possible if both keys/encryption steps use the same algorithm & public parameters.