Why is a proxy needed in proxy re-encryption?

Question

Context

Here's the usual proxy re-encryption scenario:

• Alice, with key pair $(pk_a, sk_a)$ encrypts a message $m$, producing $c = encrypt(pk_a, m)$
• Alice saves $c$ on an untrusted storge provider (Dropbox, IPFS, etc..)
• Bob, with the key pair $(pk_b, sk_b)$ asks Alice to access $c$
• Alice generates $re_{a\rightarrow b} = rekey(sk_a, pk_b)$, which she sends to a proxy
• That proxy re-encrypts $c$ in $c' = reencrypt(re_{a\rightarrow b}, c)$
• Bob can now download $c'$ and obtain the plaintext $m = decrypt(sk_b, c')$

Question

Why do we need a proxy? Can't Bob re-encrypt $c$ into $c'$ by himself? From what I've understood, the only role of the proxy is to re-encrypt $c$ and nothing more.

In other words: can Bob and the proxy be the same person/device?

Further details

If Alice sends $re_{a\rightarrow b}$ to Bob via e-mail, or by letting it be publicly accessible (i.e. storing it on IPFS), Bob should be able to re-encrypt $c$ into $c'$ by himself, provided he has the right software to do so on his device.

What I'm also interested in is uderstanding whether there are any advantages for the re-encryption step being performed by a proxy and not by the recipient himslef. I can't think of a scenario where Bob may be forced to rely on a proxy.

Answer 1

It is not necessary to have the proxy, it is mostly a convenience. You probably want to have a common place to make the secret keys available, and that's a good place to store the re-encryption keys and to perform the re-encryptions.

Also, if your proxy re-encryption algorithm is not collusion-resistant, then you might not want to give the re-encryption key to Bob, who has his own secret key.

Finally, if you have a multi-hop proxy re-encryption algorithm, you wouldn't want to distribute the re-encryption keys for all of the intermediate hops to each end recipient. That is, if you have a re-encryption key from Alice to Bob, and one from Bob to Carol, then you don't want to give the Alice-to-Bob key to Carol so she can decrypt something encrypted to Alice.

Answer 2

If Bob has the re-encryption key from Alice, then he can re-encrypt all Alice's ciphertexts stored online and then decrypt these messages. This is not good because Alice may only want to reveal some small subset of messages to Bob but not all. Similar things happen if Alice knows Bob's re-encryption key. Furthermore, the proxy is also not fully trusted, i.e., knowing Alice and Bob's re-encryption keys is not enough for the proxy to decrypt the online ciphertexts either (because it does not know Alice and Bob's private keys). On the other hand, if the proxy and, say, Bob collude, then they can decrypt all Alice's ciphertexts.