1
$\begingroup$

I was wondering if there is a way to perform proxy re-encryption for ECIES public-key encryption (i.e. given a message encrypted with Alice's public key, re-encrypt it using Bob's public key). Is that even possible?

$\endgroup$
1
$\begingroup$

In ECIES, the ciphertext is a pair:

$$rG, \text{Encrypt}_{h(raG)}(Message)$$

here:

  • G is the block generator point
  • aG is the public key that this is encrypted to (in this case, Alice's)
  • r is a random value
  • Encrypt is some symmetric cipher (the details aren't important)

What the proxy encryptor needs to do is convert this into:

$$r'G, \text{Encrypt}_{h(r'bG)}(Message)$$

Where $bG$ is Bob's public key, and $r'$ is a possibly different random value.

Surprisingly enough, this is possible, if the proxy encryptor knows the value $ab^{-1}$ (where $a, b$ are Alice's and Bob's private keys). Note that just knowing the value $ab^{-1}$, without knowing either $a$ or $b$, does not reveal either key.

What the proxy encryptor would do is replace the ciphertext with:

$$ab^{-1}(rG), \text{Encrypt}_{h(raG)}(Message)$$

(that is, multiplies the point by $ab^{-1}$ and leaves the symmetric portion alone).

If we denote $r' = ab^{-1}r$, then we note that this is the same as:

$$r'G, \text{Encrypt}_{h(r'bG)}(Message)$$

And so is a valid ciphertext encrypted with Bob's public key.

| improve this answer | |
$\endgroup$
  • $\begingroup$ Note that this only work in versions of ECIES that don't include an encoding of $rG$ as input to the KDF that generates the symmetric key to encrypt the message. $\endgroup$ – cygnusv Apr 21 '18 at 10:47
  • $\begingroup$ This approach assumes that I know both private keys, a & b. But what if I didn't? What if I only knew one private key (a) and one public key (bG)? Is there another way to make it work in this case? $\endgroup$ – Ayman Madkour Aug 19 '18 at 2:44
  • $\begingroup$ @AymanMadkour: actually, the method doesn't assume that you know both private keys, it assumes you know the single value $ab^{-1}$. Obviously, if someone had the private key $a$, he could just decrypt the message, and then perhaps reencrypt it with public key $bG$. What $ab^{-1}$ allows is the possibility of doing proxy re-encryption, without the possibility of decrypting. $\endgroup$ – poncho Aug 19 '18 at 14:38
  • $\begingroup$ But whoever is going to calculate ab-1 must know both a and b, right? $\endgroup$ – Ayman Madkour Aug 19 '18 at 19:32
  • $\begingroup$ @AymanMadkour: well, yes (actually, one could design a multiparty computation protocol between Alice and Bob), however it needn't be the re-encryptor. $\endgroup$ – poncho Aug 20 '18 at 1:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.