ElGamal-based BBS proxy re-encryption is well known, but it works on a variant of ElGamal like ($mg^r$,$g^{xr})$ not standard ElGamal ($g^r$,$mg^{xr}$). After reading the original paper, I found the authors mentioned that the proxy scheme can be extended to work with standard EIGamal encryption. But unfortunately they do not describe it in detail.

I think it may looks like:

1. Alice encrypts $m$ as $(g^{r_a},c_a = mg^{x_ar_a})$, selects another random $r_b$, and computes $r_{a->b} = y_b^{r_b} * (g^{x_ar_a})^{-1}$. Then Alice sends $(c_a, g^{r_b}, r_{a->b})$ to the proxy.
2. The proxy re-encrypts $m$ as $c_b = c_a* r_{a->b}$, and sends $(g^{r_b}, c_b)$ to Bob.
3. Bob can decrypt the cyphertext like standard ElGamal.

But I searched across the web and found nothing like this. Is there something wrong with it? Is it unsafe?

Thanks for any help or information.

ElGamal-based BBS proxy re-encryption is well known, but it works on a variant of ElGamal like ($mg^r$,$g^{xr})$ not standard ElGamal ($g^r$,$mg^{xr}$). After reading the original paper, I found the authors mentioned that the proxy scheme can be extended to work with standard EIGamal encryption. But unfortunately they do not describe it in detail.

I think it may looks like:

1. Alice encrypts $m$ as $(g^{r_a},c_a = mg^{x_ar_a})$, selects another random $r_b$, and computes $r_{a->b} = y_b^{r_b} * (g^{x_ar_a})^{-1}$. Then Alice sends $(c_a, g^{r_b}, r_{a->b})$ to the proxy.
2. The proxy re-encrypts $m$ as $c_b = c_a* r_{a->b}$, and sends $(g^{r_b}, c_b)$ to Bob.
3. Bob can decrypt the cyphertext like standard ElGamal.

But I searched across the web and found nothing like this. Is there something wrong with it? Is it unsafe?

Information added by moderator from a related question (off-topic because it asked for an implementation) Source of these pictures: https://www.cs.jhu.edu/~susan/600.641/scribes/lecture17.pdf