Suppose Alice has encrypted some plaintext $P$ to Bob. Bob wishes to re-encrypt this information to Charlie via proxy, in such a manner that:

  1. The proxy cannot obtain $P$
  2. The proxy can prove that Bob has provided a valid re-encryption key, meaning that Charlie will be able to obtain $P$ by decrypting with his private key
  3. The proxy can prove that the ciphertext originated from Alice

Is such a scheme possible?

  • $\begingroup$ Q3 implies that there is some kind of sender authentication, which is not typical in public-key encryption $\endgroup$
    – cygnusv
    Commented Mar 30, 2018 at 4:33
  • $\begingroup$ For Q2: Proxy can forward the ciphertext directly to Charlie. Why is this not suitable? $\endgroup$
    – zetaprime
    Commented Nov 1, 2018 at 6:20

1 Answer 1


PRE schemes guarantee Q1, if they are even remotely worthwhile. Alice could add a signature over her public signing key and the ciphertext to accomplish Q3. I haven't seen any works that guarantee a re-encryption key from B to C is valid.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.