ElGamal-based BBS proxy re-encryption is well known, but it works on a variant of ElGamal like ($mg^r$,$g^{xr})$ not standard ElGamal ($g^r$,$mg^{xr}$). After reading the original paper, I found the authors mentioned that the proxy scheme can be extended to work with standard EIGamal encryption. But unfortunately they do not describe it in detail.

I think it may looks like:

  1. Alice encrypts $m$ as $(g^{r_a},c_a = mg^{x_ar_a})$, selects another random $r_b$, and computes $r_{a->b} = y_b^{r_b} * (g^{x_ar_a})^{-1}$. Then Alice sends $(c_a, g^{r_b}, r_{a->b})$ to the proxy.
  2. The proxy re-encrypts $m$ as $c_b = c_a* r_{a->b}$, and sends $(g^{r_b}, c_b)$ to Bob.
  3. Bob can decrypt the cyphertext like standard ElGamal.

But I searched across the web and found nothing like this. Is there something wrong with it? Is it unsafe?

Information added by moderator from a related question (off-topic because it asked for an implementation) enter image description here enter image description here Source of these pictures: https://www.cs.jhu.edu/~susan/600.641/scribes/lecture17.pdf


2 Answers 2


There's a Python implementation in the Charm Crypto library:



Usually, when generating the re-encryptin key rk, the random number r used when encrypting can't be used.

  • 1
    $\begingroup$ The question is about the security of the scheme that it described, which the answer does not directly address. Also, $r_k$ in the answer is not in the question. FYI, this answer was brought to moderator attention because it's rather short. $\endgroup$
    – fgrieu
    Dec 22, 2023 at 17:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.