Suppose I have a big file encrypted using AES (any mode you want) with key kA. I'd like to give an untrusted proxy a kA->kB "conversion key" so that it re-encodes the file from kA to kB without learning the contents of the file or any of the keys.

Is this possible?

If not, are there any widely-supported encryption algorithms that allow that?

  • $\begingroup$ AES is not expected to form a group under functional composition. May be somehow in FHE. Fully Homomorphic Encryption (FHE) this can be achieved although the cost may not satisfy you. The steps are, roughly; 1. Encrypt your encrypted data with your FHE public keys. 2. Using AES decryption in FHE, decyrpt your data. Note that the data still encrypted with FHE 3. Encrypt your data with new AES with FHE. Now your data is encrypted with a new AES key but it is still encrypted with FHE, so you have to decrypt it! So the proxy pperformed the operation bu you still need FHE decryption. $\endgroup$ – kelalaka Jul 20 '19 at 8:15
  • $\begingroup$ Proxy re-encryption is a thing if you use RSA, where you can encrypt the file encryption key (the AES key) under RSA to one recipient, and then outsource the capability to re-encrypt ciphertexts (letting some server or third party do this on request) for that keypair to other preselected recipients (by creating a keypair-pair specific re-encryption key). After re-encryption the second receipt can decrypt the AES key with their own RSA keys $\endgroup$ – Natanael Jul 21 '19 at 13:14

Well, if you use AES in counter-mode, you could give the proxy the XOR of both counter-mode streams; he could then XOR in that XOR with the file encrypted with one key, and that'll give him the file encrypted with the other.

This does have the drawbacks:

  • This XOR is as large as the file you've encrypted

  • This XOR is specific to the IV you used to encrypt (and so if multiple files are encrypted this way, you'll need a separate conversion key for each one)

  • There is no integrity checking on the encryption format.

On the other hand, if we allow the use of public key encryption methods, we can do this with Integrated Encryption Scheme.

Here, the public key is a value $A = g^a$, and ciphertext consists of a pair $g^x$ and the actual message encrypted using symmetric crypto keyed based on the value $C = A^x$ (and so the holder of $a$ the private key can compute $A^x = C^a$, and then use that to decrypt the symmetric portions.

Now, this allows a conversion key $y = ab^{-1} \bmod q$ (where $q$ is the size of the subgroup we're working in); then, the proxy can compute $D = C^y$, and then substitute $D$ in place of $C$ in the ciphertext. Then, the holder of $b$ the other private key can compute $D^b = C^{(ab^{-1})b} = C^a = A^x$, and then use that value to decrypt.

And, the value $y$ (and the values of the public keys $A, B$) does not give the proxy enough information to deduce the private key values.

|improve this answer|||||
  • $\begingroup$ I'd like the original encrypted file to be "addressed" to nobody in particular and then be able to send a small message to the proxy that will re-code the big file for the particular recipient. P.S. If I forego AES, then there are many crypto algorithms to accomplish this, right? $\endgroup$ – Ark-kun Jul 20 '19 at 20:11
  • $\begingroup$ @Ark-kun: well, you could use the IES idea above, and have a specific public key that means "nobody" $\endgroup$ – poncho Jul 21 '19 at 2:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.