# Why is a proxy needed in proxy re-encryption?

## Context

Here's the usual proxy re-encryption scenario:

• Alice, with key pair $$(pk_a, sk_a)$$ encrypts a message $$m$$, producing $$c = encrypt(pk_a, m)$$
• Alice saves $$c$$ on an untrusted storge provider (Dropbox, IPFS, etc..)
• Bob, with the key pair $$(pk_b, sk_b)$$ asks Alice to access $$c$$
• Alice generates $$re_{a\rightarrow b} = rekey(sk_a, pk_b)$$, which she sends to a proxy
• That proxy re-encrypts $$c$$ in $$c' = reencrypt(re_{a\rightarrow b}, c)$$
• Bob can now download $$c'$$ and obtain the plaintext $$m = decrypt(sk_b, c')$$

## Question

Why do we need a proxy? Can't Bob re-encrypt $$c$$ into $$c'$$ by himself? From what I've understood, the only role of the proxy is to re-encrypt $$c$$ and nothing more.

In other words: can Bob and the proxy be the same person/device?

## Further details

If Alice sends $$re_{a\rightarrow b}$$ to Bob via e-mail, or by letting it be publicly accessible (i.e. storing it on IPFS), Bob should be able to re-encrypt $$c$$ into $$c'$$ by himself, provided he has the right software to do so on his device.

What I'm also interested in is uderstanding whether there are any advantages for the re-encryption step being performed by a proxy and not by the recipient himslef. I can't think of a scenario where Bob may be forced to rely on a proxy.

• Basic Question: Why can't Alice just generate a secret key, encrypt the data with the secret-key and share the secret key encrypted by Bob's public key? Only Bob can decrypt the secret key and use it to decrypt. Similar to HTTPS/TLS? Nov 8 '20 at 7:36
• @Harish S: Welcome to crypto-SE. If you want to ask a related question, please don't make it an answer. The best for you, before you have enough reputation (allowing to comment), is to ask separate, self-contained questions. Meanwhile, I have changed your additional-question-as-an-answer into the above comment.
– fgrieu
Nov 8 '20 at 9:52