I wrote an algorithm to implement a suggestion in a paper by Ivan and Dodis to convert a regular ElGamal encryption scheme into a proxy re-encryption one (it's at page 6, left column of this but I asked a question related to it on SO where you can see the maths quicker).

The part I'm referring to is this one.


The scheme works by splitting a private key $x$ into $x_1$ and $x_2$.

My question is: if I don't want to share my private key with someone, could I split it in $x_1$ and $x_2$, decrypt part of it using $x_1$, share that encrypted text with someone as well as $x_2$ (probably encrypted under their public key) and have them decrypt it? How easy would it be for them to figure out the whole private key given that information and how could that threat be diminished (if it could at all)?


1 Answer 1


Disclaimer: The use cases for proxy re-encryption are very specific. From your description it is not clear to me why you don't just encrypt the message with a different key for your someone.

Looking at the scheme it seems to me that someone only gets $x_2$ and cannot use that to learn anything about $x_1$. Even given multiple pairs $x = x_1^{(i)} + x_2^{(i)}$; if only the $x_2^{(i)}$ are known any $x'$ could be the correct key for $x_1^{(i)} = x' - x_2^{(i)}$.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.