First of all I have to say it's a homework question but since I have no one to consult with, I ended up here :)

Suppose a case in which you are the manager of a company and all employees encrypt their messages with your public key and send them to you.You can decrypt them with your private key and read them.

Now suppose you're leaving for a vacation and want your secretary to be able to read the emails but you don't want her to have your private key.

How would you go at solving this issue?

Any hint or suggestion is greatly appreciated :)

  • 1
    $\begingroup$ What other infrastructure is available? In particular, how is the manager's public key distributed to the employees and how do they verify its integrity? Without any further information, the only way I see is to automatically decrypt all incoming mail on a trusted machine and re-encrypt them using the secretary's key. $\endgroup$
    – yyyyyyy
    Dec 24, 2014 at 21:15
  • $\begingroup$ Well there is no other infrastructure mentioned in the question.But provided any other infrastructure, what's possible ? Can't it be done like how CAs know each other and approve each other ? $\endgroup$
    – SpiXel
    Dec 24, 2014 at 21:29

2 Answers 2


You are looking for Proxy Re-Encryption. From a high-level viewpoint, a proxy re-encryption scheme is an asymmetric encryption scheme that permits a proxy to transform ciphertexts under Alice's public key into ciphertexts decryptable by Bob's secret key. In order to do this, the delegator $A$ gives a special re-encryption key $rk_{A \rightarrow B}$ to the proxy; this key makes the transformation from $A$ to $B$ possible. So, besides defining traditional encryption and decryption functions, a proxy re-encryption scheme also defines a re-encryption function for executing the transformation.

Your example is one of the traditional use cases of proxy re-encryption. See for instance the introduction of this paper from Ateniese et al. In this case, the manager $A$ creates a re-encryption key $rk_{A \rightarrow B}$ for her secretary $B$, and handles this re-encryption key to the email server. The server simply has to re-encrypt all encrypted emails under the public key of $A$ to encrypted emails under the public key of $B$.

Udpate: For the sake of clarity, I provide here an example of Proxy Re-Encryption scheme. The following is one of the simplest schemes, proposed by Blaze, Bleumer and Strauss in 1998. It is based on the ElGamal encryption scheme. Besides to the usual primitives for key generation, encryption and decryption, the scheme has a re-encryption key generation function and a re-encryption function:

$KeyGen() = (pk = g^x, sk = x)$, for random $x$.

$Enc(pk = g^x,m) = (pk^r, m\cdot g^r) = (g^{xr}, m\cdot g^r)$, for random $r$

$Dec(sk = x, c = (c_1, c_2)) = c_2 / c_1^\frac{1}{sk}$

$ReKeyGen(sk_1 = x, sk_2 = y ) = sk_2 / sk_1 = y / x$

$ReEnc(rk = y/x, c = (c_1, c_2)) = (c_1^{rk}, c_2) = (g^{yr}, m\cdot g^r)$

Note that this scheme is what the proxy re-encryption literature calls "interactive", that is, the re-encryption key generation needs both secret keys as inputs. This is an undesired property, but I preferred to show this scheme because of its simplicity. There are however plenty of non-interactive proxy re-encryption schemes (the re-encryption key is generated from the secret key of the delegator and the public key of the delegatee) such as the ones from Ateniese et al. (see link above).

  • $\begingroup$ Do you have some examples of (public key) encryption schemes which allow this (with a reencryption key which is not just the pair $(d_A, e_B)$, i.e. decryption followed by encryption)? $\endgroup$ Dec 26, 2014 at 14:01
  • $\begingroup$ @PaŭloEbermann: I have edited my answer to include a prominent example of PRE scheme. There are lots of more advanced proxy re-encryption schemes in the literature, most of them based on pairings. $\endgroup$
    – cygnusv
    Dec 26, 2014 at 16:22

I think that this is not possible with a conventionnal public Key (Probably I'm wrong ?). But this question could easilly be solved by IBE as introduced by Dan Boneh in the seminal paper "Identity-Based Encryption from the Weil Pairing. This new system introduced in the early 2000, allows the Delegation of Decryption Keys, but this require the set up a new system parameters.

Cf http://crypto.stanford.edu/~dabo/papers/bfibe.pdf and refer to 1.1.2 which describes how to delegate Decryption Keys to different entities.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.