Suppose Alice has encrypted some plaintext $P$ to Bob. Bob wishes to re-encrypt this information to Charlie via proxy, in such a manner that:
- The proxy cannot obtain $P$
- The proxy can prove that Bob has provided a valid re-encryption key, meaning that Charlie will be able to obtain $P$ by decrypting with his private key
- The proxy can prove that the ciphertext originated from Alice
Is such a scheme possible?