What's the difference between single key-pair public key encryption and proxy re-encryption?

Question

Proxy Re-Encryption provides the ability to transform a ciphertext encrypted under some key to the one under another key. This seems interesting. But, something seems strange.

Suppose Alice has a key pair $(sk_a, pk_a)$ and Bob also has a key pair $(sk_b, pk_b)$. If Alice and Bob generate a proxy re-encryption key to transform a ciphertext under $pk_a$ to the one under $pk_b$ and vice versa, they can send messages without revealing their secret keys.

At this point, what about the following scenario? Bob securely transmits his public key $pk_b$ to Alice. Then, Alice encrypts her message $m$ using $pk_b$. There is no need to transform the ciphertext. Also, Alice can send Bob her public key $pk_a$ when she wants to receive the message from Bob.

What is the advantage of proxy re-encryption? I think there is no potential difference between a standard public key encryption scheme and proxy re-encryption.

Answer 1

With two parties, using proxy re-encryption does indeed not make much sense. It becomes interesting when there are more parties. For example, suppose you receive encrypted mails, that transit through a server. Then you could want to forward one of your encrypted mails, stored on the server, to someone else (say, Bob). With a proxy scheme, you can just ask the server to convert this encrypted mail into a mail encrypted with the key of Bob, and to send it to Bob. In general, it provides a convenient way of managing databases of encrypted files in a multi-user scenario.

You can find more applications in the introduction of any paper on proxy re-encryption. For example, page 3 of this paper discusses examples in more details. This paper also mentions other applications (with references) in the third paragraph of its introduction.

Answer 2

The main advantage of Proxy Re-Encryption with respect to other approaches is in data sharing scenarios where you have multiple data producers and data consumers, which may be not known in advance.

The data owner (usually called Alice in PRE literature) only needs to be online to create re-encryption keys for any data consumer (usually named Bob) she wants and to send these keys to the proxies. She can repeat this process whenever she wants, irrespective of the moment the data is encrypted.

Data producers only need Alice's public key. As said before, data can be encrypted before or after Alice delegates access to Bob (i.e., creates a re-encryption key)

A single piece of encrypted data can be shared with an arbitrary number of Bobs, assuming there's a re-encryption key that allows it.