I was wondering if there is a way to perform proxy re-encryption for ECIES public-key encryption (i.e. given a message encrypted with Alice's public key, re-encrypt it using Bob's public key). Is that even possible?
1
-
$\begingroup$ patents.google.com/patent/US20180091301A1/en $\endgroup$– cygnusvCommented Apr 21, 2018 at 10:45
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
5
In ECIES, the ciphertext is a pair:
$$rG, \text{Encrypt}_{h(raG)}(Message)$$
here:
- G is the block generator point
- aG is the public key that this is encrypted to (in this case, Alice's)
- r is a random value
- Encrypt is some symmetric cipher (the details aren't important)
What the proxy encryptor needs to do is convert this into:
$$r'G, \text{Encrypt}_{h(r'bG)}(Message)$$
Where $bG$ is Bob's public key, and $r'$ is a possibly different random value.
Surprisingly enough, this is possible, if the proxy encryptor knows the value $ab^{-1}$ (where $a, b$ are Alice's and Bob's private keys). Note that just knowing the value $ab^{-1}$, without knowing either $a$ or $b$, does not reveal either key.
What the proxy encryptor would do is replace the ciphertext with:
$$ab^{-1}(rG), \text{Encrypt}_{h(raG)}(Message)$$
(that is, multiplies the point by $ab^{-1}$ and leaves the symmetric portion alone).
If we denote $r' = ab^{-1}r$, then we note that this is the same as:
$$r'G, \text{Encrypt}_{h(r'bG)}(Message)$$
And so is a valid ciphertext encrypted with Bob's public key.
-
$\begingroup$ Note that this only work in versions of ECIES that don't include an encoding of $rG$ as input to the KDF that generates the symmetric key to encrypt the message. $\endgroup$– cygnusvCommented Apr 21, 2018 at 10:47
-
$\begingroup$ This approach assumes that I know both private keys, a & b. But what if I didn't? What if I only knew one private key (a) and one public key (bG)? Is there another way to make it work in this case? $\endgroup$ Commented Aug 19, 2018 at 2:44
-
$\begingroup$ @AymanMadkour: actually, the method doesn't assume that you know both private keys, it assumes you know the single value $ab^{-1}$. Obviously, if someone had the private key $a$, he could just decrypt the message, and then perhaps reencrypt it with public key $bG$. What $ab^{-1}$ allows is the possibility of doing proxy re-encryption, without the possibility of decrypting. $\endgroup$– ponchoCommented Aug 19, 2018 at 14:38
-
$\begingroup$ But whoever is going to calculate ab-1 must know both a and b, right? $\endgroup$ Commented Aug 19, 2018 at 19:32
-
$\begingroup$ @AymanMadkour: well, yes (actually, one could design a multiparty computation protocol between Alice and Bob), however it needn't be the re-encryptor. $\endgroup$– ponchoCommented Aug 20, 2018 at 1:10
$\begingroup$
$\endgroup$
If we slightly change the requirements in the question, I can see a modified version of @poncho's solution that doesn't require Alice or the proxy to know Bob's private key.
- Alice generates a new keypair c, cG.
- Alice sends ac^-1 to the proxy.
- Alice encrypts c with Bob's public key bG and sends it to the proxy.
- The proxy replaces the cyphertext with (ac^-1(rG), ...) and sends it along with the encrypted c to Bob.
- Bob can now decrypt the message from the proxy using c.
