I was wondering if there is a way to perform proxy re-encryption for ECIES public-key encryption (i.e. given a message encrypted with Alice's public key, re-encrypt it using Bob's public key). Is that even possible?


2 Answers 2


In ECIES, the ciphertext is a pair:

$$rG, \text{Encrypt}_{h(raG)}(Message)$$


  • G is the block generator point
  • aG is the public key that this is encrypted to (in this case, Alice's)
  • r is a random value
  • Encrypt is some symmetric cipher (the details aren't important)

What the proxy encryptor needs to do is convert this into:

$$r'G, \text{Encrypt}_{h(r'bG)}(Message)$$

Where $bG$ is Bob's public key, and $r'$ is a possibly different random value.

Surprisingly enough, this is possible, if the proxy encryptor knows the value $ab^{-1}$ (where $a, b$ are Alice's and Bob's private keys). Note that just knowing the value $ab^{-1}$, without knowing either $a$ or $b$, does not reveal either key.

What the proxy encryptor would do is replace the ciphertext with:

$$ab^{-1}(rG), \text{Encrypt}_{h(raG)}(Message)$$

(that is, multiplies the point by $ab^{-1}$ and leaves the symmetric portion alone).

If we denote $r' = ab^{-1}r$, then we note that this is the same as:

$$r'G, \text{Encrypt}_{h(r'bG)}(Message)$$

And so is a valid ciphertext encrypted with Bob's public key.

  • $\begingroup$ Note that this only work in versions of ECIES that don't include an encoding of $rG$ as input to the KDF that generates the symmetric key to encrypt the message. $\endgroup$
    – cygnusv
    Commented Apr 21, 2018 at 10:47
  • $\begingroup$ This approach assumes that I know both private keys, a & b. But what if I didn't? What if I only knew one private key (a) and one public key (bG)? Is there another way to make it work in this case? $\endgroup$ Commented Aug 19, 2018 at 2:44
  • $\begingroup$ @AymanMadkour: actually, the method doesn't assume that you know both private keys, it assumes you know the single value $ab^{-1}$. Obviously, if someone had the private key $a$, he could just decrypt the message, and then perhaps reencrypt it with public key $bG$. What $ab^{-1}$ allows is the possibility of doing proxy re-encryption, without the possibility of decrypting. $\endgroup$
    – poncho
    Commented Aug 19, 2018 at 14:38
  • $\begingroup$ But whoever is going to calculate ab-1 must know both a and b, right? $\endgroup$ Commented Aug 19, 2018 at 19:32
  • $\begingroup$ @AymanMadkour: well, yes (actually, one could design a multiparty computation protocol between Alice and Bob), however it needn't be the re-encryptor. $\endgroup$
    – poncho
    Commented Aug 20, 2018 at 1:10

If we slightly change the requirements in the question, I can see a modified version of @poncho's solution that doesn't require Alice or the proxy to know Bob's private key.

  • Alice generates a new keypair c, cG.
  • Alice sends ac^-1 to the proxy.
  • Alice encrypts c with Bob's public key bG and sends it to the proxy.
  • The proxy replaces the cyphertext with (ac^-1(rG), ...) and sends it along with the encrypted c to Bob.
  • Bob can now decrypt the message from the proxy using c.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.