I am wondering, if it is possible to split a secret (s.th. like shamir's secret sharing) which can be used to generate a re-encryption key in proxy re-encryption and only serve the splitted portions for the sake of generating a re-encryption key which can only be used for a specific public key?

So something like:

sec = secret to decrypt message
sec1 = portion of sec
sec2 = portion of sec

pkr = public key of receiver of the message
pkm = public key of bad actor who wants to re-encrypt for him
sec1_pkr = getKey(sec1, pkr)
sec2_pkr = getKey(sec2, pkr)

reKeyPkr = getReKey(sec1_pkr, sec2_pkr, [secn_pkr...], pkr) = re-encryption key for receiver pkr
reKeyPkm != getReKey(sec1_pkr, sec2_pkr, [secn_pkr...], pkm) = re-encryption key for receiver pkm

1 Answer 1


Something similar to what you ask, although not exactly, is the PRE scheme called Umbral. It has a reference implementation called pyUmbral. (Disclaimer: I'm the author of Umbral).

Umbral is a threshold PRE scheme, which means that re-encryption is divided among several proxies and at least certain threshold of them has to cooperate. With Umbral, the delegator can generate M-out-of-N re-encryption keys, in a way similar to Shamir's Secret Sharing.

I think you probably can reuse some of the techniques used in Umbral to split the delegator's private key and generate re-encryption key shares from the shares of this private key, rather than Umbral's approach which consists in generating directly re-encryption key shares. Anyway, both approaches should be very similar from the perspective of the application of Shamir's Secret Sharing.

I also think these techniques can be easily adapted to pairing-based PRE schemes, such as AFGH and others.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.