Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there such an algorithm that would allow to upgrade the encryption of a RSA-encrypted message without revealing the plaintext to the untrusted user?

Basically, such an algorithm would probably be split in two parts.

  1. The algorithm would take the old private key and the new public key and generate a sort of intermediate key.
  2. The key would then be distributed to untrusted parties who could upgrade their encrypted messages to the new keypair using the intermediate key and (maybe) the new public key.

Neither the old private key nor the new private key should not be easily recoverable (computationaly infeasible) from the intermediate key, so untrusted parties wouldn't be able to recover the plaintext.

Now I supose that such a scheme does not exist, because I don't see a real use case for it, but it would be interesting to know if such a thing can be done.

share|improve this question
This is called proxy re-encryption and there are a lot of ways of doing it: – PulpSpy May 7 '12 at 20:43
Section 4.3 of this paper has an example for RSA but it is unidirectional: – PulpSpy May 7 '12 at 20:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.