Is there such an algorithm that would allow to upgrade the encryption of an RSA-encrypted message without revealing the plaintext to the untrusted user?

Basically, such an algorithm would probably be split in two parts.

  1. The algorithm would take the old private key and the new public key and generate a sort of intermediate key.
  2. The key would then be distributed to untrusted parties who could upgrade their encrypted messages to the new keypair using the intermediate key and (maybe) the new public key.

Neither the old private key nor the new private key should not be easily recoverable (computationaly infeasible) from the intermediate key, so untrusted parties wouldn't be able to recover the plaintext.

Now I suppose that such a scheme does not exist, because I don't see a real use case for it, but it would be interesting to know if such a thing can be done.

  • 4
    $\begingroup$ This is called proxy re-encryption and there are a lot of ways of doing it: en.wikipedia.org/wiki/Proxy_re-encryption $\endgroup$
    – PulpSpy
    May 7, 2012 at 20:43
  • 2
    $\begingroup$ Section 4.3 of this paper has an example for RSA but it is unidirectional: www.isoc.org/isoc/conferences/ndss/03/proceedings/papers/14.pdf $\endgroup$
    – PulpSpy
    May 7, 2012 at 20:46

1 Answer 1


As PulpSpy have mentioned, It is called proxy re-encryption. A company called NyCypher have implemented it but with secp251 keys https://blog.nucypher.com/proxy-re-encryption-playground-in-python-3bc66170b9bf. Other option is charm-crypto,https://github.com/JHUISI/charm/tree/2.7-master


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.