Decrypting only message product - is it possible? Ok, I'm looking for a way to be able to decrypt ONLY message product and not individual messages. The message product can contain an arbitrary number of messages as long as it's greater than some margin. Probably it's impossible, but I need to make sure.

Suppose it's some weird inverse DKG: you have 5 shares of a public key and can encrypt messages (numbers) using any share. However, you can decrypt only product of messages, that contains at least one message encrypted with each share. However, there is NO escrow key and no possibility to decrypt just one message. 

I've been thinking about id-based encryption schemes, but it always seems to have escrow key and allows to decrypt individual messages. Commitments do not work with an arbitrary number  (>=5) of messages in a product. Any ideas?

Is it even possible in theory to design such scheme? 

I know, the problem is kind of weird, but it bugs me that I can't find a solution or prove that there is no solution at all.
What's wrong with the obvious solution:


Each party creates a public-private key pair.
The public key is the combination of all public keys.
Encryption is done in a nested fashion to all public keys.
Decryption is done sequentially by all holders of key shares.


If some special property of a symmetric sharing scheme is desired replace the last two with
3. Encryption is done by creating shares according to the symmetric scheme and encrypting each share with a different public key
4. Decryption is performed just as in whatever symmetric sharing scheme was desired

Of course the size of the public key is linear in the number of shares. This is just the obvious solution not a great one.