Is there any asymmetric cryptography algorithm which will allow recursive encryption.

c1 = crypt(encryptionKey1, 'Hello world');
decrypt(decryptionKey1, c1) == 'Hello world'

c2 = crypt(encryptionKey2, c1);
decrypt(decryptionKey2, c2) == c1;

decrypt(decryptionKey3, c2) == 'Hello World' 

Knowing first and second key pair it is possible to calculate third key. Knowing third key and second key pair it is not possible calculate first key pair.

I've made similar question on security. but it seems that an answer requires more theoretical approach

  • $\begingroup$ Please don't cross-post the same question on two StackExchange sites; that's discouraged. Please pick one to keep, and for the other, click the "flag" button to flag the moderator to ask them to close it. $\endgroup$
    – D.W.
    Feb 9, 2013 at 1:19

2 Answers 2


There are schemes of this form. The keyword is "proxy re-encryption". Searching the cryptographic literature will find you instances of schemes like this. I think that's what you're looking for; in any case, I suggest you read about them, determine whether they meet your requirements, and if not, explain in your question how your problem differs.

However, my sense is that it's rare to run into practical situations where proxy re-encryption cryptosystems are truly necessary. Instead, there are often simpler solutions (e.g., relying upon parties to do explicit key management). If you ask on IT Security about the exact application, they can probably help you find a simple solution using key management and possibly a trusted party.


The simple scheme where decryptionKey3 = (decryptionKey1, decryptionKey2), and where decryption using such a combined key is simply defined as decrypting the message with each of the component keys in turn, satisfies all your requirements except the last one.

Assuming that the encryption keys are public (i.e. potentially known by all parties), or at least that knowing the private (decryption) half of a keypair lets you calculate the public (encryption) half of it, then the last requirement is not satisfiable in any meaningful sense.

Specifically, if you did have such a scheme, and you knew keys 2 and 3 and had a message encrypted using key 1, you could decrypt it by first encrypting it with the public key 2 and then decrypting it with key 3. Thus, even if knowing keys 2 and 3 didn't technically allow you to calculate key 1, it would still let you to do anything that knowing key 1 would let you do.

  • $\begingroup$ Is there any algorithm where those keys could be completely independent? $\endgroup$ Dec 5, 2012 at 11:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.