# Proxy Re-Encryption with provable re-encryption target

Suppose Alice has encrypted some plaintext $P$ to Bob. Bob wishes to re-encrypt this information to Charlie via proxy, in such a manner that:

1. The proxy cannot obtain $P$
2. The proxy can prove that Bob has provided a valid re-encryption key, meaning that Charlie will be able to obtain $P$ by decrypting with his private key
3. The proxy can prove that the ciphertext originated from Alice

Is such a scheme possible?

• Q3 implies that there is some kind of sender authentication, which is not typical in public-key encryption – cygnusv Mar 30 '18 at 4:33
• For Q2: Proxy can forward the ciphertext directly to Charlie. Why is this not suitable? – zetaprime Nov 1 '18 at 6:20

## 1 Answer

PRE schemes guarantee Q1, if they are even remotely worthwhile. Alice could add a signature over her public signing key and the ciphertext to accomplish Q3. I haven't seen any works that guarantee a re-encryption key from B to C is valid.