# Is there a proxy re-encryption algorithm for Elliptic Curve ECIES?

I was wondering if there is a way to perform proxy re-encryption for ECIES public-key encryption (i.e. given a message encrypted with Alice's public key, re-encrypt it using Bob's public key). Is that even possible?

In ECIES, the ciphertext is a pair:

$$rG, \text{Encrypt}_{h(raG)}(Message)$$

here:

• G is the block generator point
• aG is the public key that this is encrypted to (in this case, Alice's)
• r is a random value
• Encrypt is some symmetric cipher (the details aren't important)

What the proxy encryptor needs to do is convert this into:

$$r'G, \text{Encrypt}_{h(r'bG)}(Message)$$

Where $bG$ is Bob's public key, and $r'$ is a possibly different random value.

Surprisingly enough, this is possible, if the proxy encryptor knows the value $ab^{-1}$ (where $a, b$ are Alice's and Bob's private keys). Note that just knowing the value $ab^{-1}$, without knowing either $a$ or $b$, does not reveal either key.

What the proxy encryptor would do is replace the ciphertext with:

$$ab^{-1}(rG), \text{Encrypt}_{h(raG)}(Message)$$

(that is, multiplies the point by $ab^{-1}$ and leaves the symmetric portion alone).

If we denote $r' = ab^{-1}r$, then we note that this is the same as:

$$r'G, \text{Encrypt}_{h(r'bG)}(Message)$$

And so is a valid ciphertext encrypted with Bob's public key.

• Note that this only work in versions of ECIES that don't include an encoding of $rG$ as input to the KDF that generates the symmetric key to encrypt the message. Commented Apr 21, 2018 at 10:47
• This approach assumes that I know both private keys, a & b. But what if I didn't? What if I only knew one private key (a) and one public key (bG)? Is there another way to make it work in this case? Commented Aug 19, 2018 at 2:44
• @AymanMadkour: actually, the method doesn't assume that you know both private keys, it assumes you know the single value $ab^{-1}$. Obviously, if someone had the private key $a$, he could just decrypt the message, and then perhaps reencrypt it with public key $bG$. What $ab^{-1}$ allows is the possibility of doing proxy re-encryption, without the possibility of decrypting. Commented Aug 19, 2018 at 14:38
• But whoever is going to calculate ab-1 must know both a and b, right? Commented Aug 19, 2018 at 19:32
• @AymanMadkour: well, yes (actually, one could design a multiparty computation protocol between Alice and Bob), however it needn't be the re-encryptor. Commented Aug 20, 2018 at 1:10

If we slightly change the requirements in the question, I can see a modified version of @poncho's solution that doesn't require Alice or the proxy to know Bob's private key.

• Alice generates a new keypair c, cG.
• Alice sends ac^-1 to the proxy.
• Alice encrypts c with Bob's public key bG and sends it to the proxy.
• The proxy replaces the cyphertext with (ac^-1(rG), ...) and sends it along with the encrypted c to Bob.
• Bob can now decrypt the message from the proxy using c.