# Is there a proxy re-encryption algorithm for Elliptic Curve ECIES?

I was wondering if there is a way to perform proxy re-encryption for ECIES public-key encryption (i.e. given a message encrypted with Alice's public key, re-encrypt it using Bob's public key). Is that even possible?

In ECIES, the ciphertext is a pair:

$$rG, \text{Encrypt}_{h(raG)}(Message)$$

here:

• G is the block generator point
• aG is the public key that this is encrypted to (in this case, Alice's)
• r is a random value
• Encrypt is some symmetric cipher (the details aren't important)

What the proxy encryptor needs to do is convert this into:

$$r'G, \text{Encrypt}_{h(r'bG)}(Message)$$

Where $bG$ is Bob's public key, and $r'$ is a possibly different random value.

Surprisingly enough, this is possible, if the proxy encryptor knows the value $ab^{-1}$ (where $a, b$ are Alice's and Bob's private keys). Note that just knowing the value $ab^{-1}$, without knowing either $a$ or $b$, does not reveal either key.

What the proxy encryptor would do is replace the ciphertext with:

$$ab^{-1}(rG), \text{Encrypt}_{h(raG)}(Message)$$

(that is, multiplies the point by $ab^{-1}$ and leaves the symmetric portion alone).

If we denote $r' = ab^{-1}r$, then we note that this is the same as:

$$r'G, \text{Encrypt}_{h(r'bG)}(Message)$$

And so is a valid ciphertext encrypted with Bob's public key.

• Note that this only work in versions of ECIES that don't include an encoding of $rG$ as input to the KDF that generates the symmetric key to encrypt the message. – cygnusv Apr 21 '18 at 10:47
• This approach assumes that I know both private keys, a & b. But what if I didn't? What if I only knew one private key (a) and one public key (bG)? Is there another way to make it work in this case? – Ayman Madkour Aug 19 '18 at 2:44
• @AymanMadkour: actually, the method doesn't assume that you know both private keys, it assumes you know the single value $ab^{-1}$. Obviously, if someone had the private key $a$, he could just decrypt the message, and then perhaps reencrypt it with public key $bG$. What $ab^{-1}$ allows is the possibility of doing proxy re-encryption, without the possibility of decrypting. – poncho Aug 19 '18 at 14:38
• But whoever is going to calculate ab-1 must know both a and b, right? – Ayman Madkour Aug 19 '18 at 19:32
• @AymanMadkour: well, yes (actually, one could design a multiparty computation protocol between Alice and Bob), however it needn't be the re-encryptor. – poncho Aug 20 '18 at 1:10