I had asked a question related to this before: Oblivious Decryption: Decrypting with a private key, without knowing the message
@rikhavshah has an answer, which I would like to discuss the security of.
Simply put:
- Alice has an RSA public key $(e, N)$ and a private key $(d,N)$
- There's a ciphertext $x$, padded and encrypted using Alice's public key.
- Bob doesn't know what the padded plaintext $m_p$ is, but has the ciphertext $x$.
- Bob randomly chooses a mask $r$ from $\{1,\cdots,N-1\}$, calculates $x\,r^e\bmod N$ and sends it to Alice.
- Alice decrypts $x\,r^e$ by computing $(x\,r^e)^d\bmod N$, which is also $x^d\,r\bmod N$, and sends it to Bob
- Bob multiples the value by $r^{-1}$ (the modular multiplicative inverse of $r$ modulo $N$, which with overwhelming odds is well-defined) to extract $x^d\bmod N = m_p$. And later on removes/decodes the padding to extract $m$.
This way, Alice decrypts $x$, without knowing what $m_p$ is. Bob knows the value of $m_p$ without knowing the value of Alice's private exponent $d$
Is there a known attack, that this scheme is vulnerable to? Can the choice of $r$ make this more or less secure? Or simply, how can we approach this scheme and make it secure?
Note: as @rikhavshah has also mentioned in their answer, this has a potential attack where Bob can get Alice to decrypt anything encrypted with her public key. But this is actually what the scheme requires. So I wouldn't consider this as a vulnerability. And please assume, they are using a signature scheme to verify each-others identity.