Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In proxy re-encryption schemes, a proxy is given special information that allows it to translate a ciphertext under one key into a ciphertext of the same message under a different key.

How practical is PRE? Is it possible for achieving PRE for AES?

share|improve this question

Proxy re-encryption schemes are entirely practical. This is certainly true for AES symmetric encryption, as the proxy does little more than decryption with key 1, followed by encryption with key 2. This is called the "Naïve Way" in this lecture.

Now if PRE is suitable for a specific uses case is an entirely different matter. It depends on how secure the proxy itself is. If you require additional security in the PRE protocol itself you may have to go for a protocol that uses asymmetric encryption primitives.

Beware that a proxy more or less implies communication over insecure networks. If man-in-the-middle attacks are applicable then you should add an authentication tag to your messages.

More detail is required to answer your question for a specific use case.

share|improve this answer
Note that I got this far by reading the lecture and the Wikipedia page that you pointed to. The Wikipedia page leaves a lot to be desired and should definitely not be used as a trusted source for this particular subject at the time of writing. I am not an expert on PRE in any way. – Maarten Bodewes Jun 24 '13 at 19:45
I would ask if there is a way to do this without the proxy being able to see to the plaintext during this operation. I suppose with AES this is not possible, but some asymmetric schemes might allow it (maybe if with special tweaks). – Paŭlo Ebermann Jun 25 '13 at 20:03
@PaŭloEbermann there are some pointers about this (using ElGamal) in the linked paper - as you said with just AES (as described in the question) there is a very strong feeling that this is not possible, but I don't have any mathematical proof for that. – Maarten Bodewes Jun 26 '13 at 14:05
@rath well, basically we mean "attacker-in-the-middle" when we talk about MITM, and MITM certainly may apply between the connections of proxy-re-encryption. If you don't mind I'll keep using MITM though, AITM does not have a good sound to it :) – Maarten Bodewes Jul 24 '13 at 23:51
The plaintext could be encrypted with the dual 128-bit keys, one being known to all users of the proxy (but not the proxy) and another that is unique to each user but known to the proxy. This would allow the proxy to designate the recipient but not see the plaintext, and not allow anyone but the recipient and the sender to decrypt the message. This in essence becomes a key management problem with multiple targets, as key recovery on the proxy and a single user may compromise the entire system. – Richie Frame Sep 25 '13 at 5:33
up vote 0 down vote accepted

Conversion and Proxy Functions for Symmetric Key Ciphers By Cook and Keromytis has conversion techniques that seems to be practical for achieving PRE .

share|improve this answer
Yes, but the techniques are nothing beyond the obvious ones. – DrLecter Nov 16 '13 at 14:34
Do you know this one? But not really more efficient than the ones in your cited paper. – DrLecter Nov 16 '13 at 14:45
i wanted practical ones its ok if they are obvious ;) – sashank Nov 16 '13 at 15:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.