ElGamal proxy re-encryption

Question

I wrote an algorithm to implement a suggestion in a paper by Ivan and Dodis to convert a regular ElGamal encryption scheme into a proxy re-encryption one (it's at page 6, left column of this but I asked a question related to it on SO where you can see the maths quicker).

The part I'm referring to is this one.

$$\frac{mg^{xr}}{g^{rx_1}}=\frac{mg^{(x_1+x_2)r}}{g^{rx_1}}=\frac{mg^{(x_1)r}mg^{(x_2)r}}{g^{rx_1}}=mg^{(x_2)r}$$

The scheme works by splitting a private key $x$ into $x_1$ and $x_2$.

My question is: if I don't want to share my private key with someone, could I split it in $x_1$ and $x_2$, decrypt part of it using $x_1$, share that encrypted text with someone as well as $x_2$ (probably encrypted under their public key) and have them decrypt it? How easy would it be for them to figure out the whole private key given that information and how could that threat be diminished (if it could at all)?

Answer 1

Disclaimer: The use cases for proxy re-encryption are very specific. From your description it is not clear to me why you don't just encrypt the message with a different key for your someone.

Looking at the scheme it seems to me that someone only gets $x_2$ and cannot use that to learn anything about $x_1$. Even given multiple pairs $x = x_1^{(i)} + x_2^{(i)}$; if only the $x_2^{(i)}$ are known any $x'$ could be the correct key for $x_1^{(i)} = x' - x_2^{(i)}$.