Ask HN: Encryption algorithm with *multiple* decryption keys?

This will not take much more space as only the master key is encrypted multiple times.

Now anybody who has one of the keys can decrypt the master key and subsequently decrypt the cleartext.

In that case... dumb answer... but couldn't you just encrypt it twice (or n times), with n separate keys? Or encrypt the actual thing with a symmetric key, then separately encrypt the symmetric key with a public keypair for each of n users, such that any one of them could regain the symmetric key for that one thing (but not anyone else's private keys).

I'm assuming you mean "it requires 2 or more keys but less than all of them", so I'd check variations of: https://en.wikipedia.org/wiki/Secret_sharing

The cases for "any individual key is enough" or "all keys required" are much simpler.

https://crypto.stackexchange.com/questions/39397/one-encrypt...

You can encrypt the data encryption key with, say, any 2 keys out of 3. You concatenate any two keys into a single key, and encrypt the master key with that. That gives you Shamir scheme, that used in crypto currencies.