Proxy Re-Encryption (PRE)

The re-encryption key (RK) allows a proxy to transform ciphertexts from Alice to Bob, but not from Bob to Alice. This is a critical security property ensuring that delegation is a one-way street.

• Mechanism: The RK is mathematically constructed using Alice's secret key and Bob's public key, making it computationally infeasible to reverse.
• Contrast: Bi-directional schemes exist but are less common in enterprise access control where strict hierarchical or need-to-know delegation is required.
• Example: A CTO can delegate access to quarterly financial reports to an auditor without the auditor being able to re-delegate or reverse the flow to access the CTO's other files.

The proxy cannot combine multiple re-encryption keys to create new, unauthorized delegation chains. Possessing RK(A→B) and RK(B→C) does not allow the proxy to compute RK(A→C).

• Security Implication: This prevents privilege escalation attacks where a semi-trusted proxy could chain delegations to grant access beyond the original data owner's intent.
• Collusion Resistance: Even if the proxy colludes with delegate Bob, they cannot compute Alice's secret key, a property known as collusion safety.
• Real-World Scenario: A cloud storage gateway holding re-encryption keys for multiple departments cannot silently grant the marketing team access to HR documents by chaining keys.

The proxy server performing the re-encryption operation never sees the underlying plaintext data at any point in the process. It transforms one ciphertext into another while both remain encrypted.

• Blind Transformation: The proxy applies the re-encryption key to the ciphertext through a mathematical operation that changes the encapsulating public key without decryption.
• Trust Model: The proxy is semi-trusted—trusted to perform the transformation correctly and honestly, but not trusted with access to the data itself.
• Use Case: A managed file transfer service can convert files encrypted for an on-premises server into files encrypted for a cloud analytics platform without ever reading the file contents.

A delegate (Bob) decrypts a re-encrypted ciphertext using their own existing private key. No new key material, software, or hardware tokens are required on the delegate's side.

• Seamless User Experience: Bob does not need to manage separate keys for each delegator. His single private key decrypts both his own ciphertexts and any ciphertexts re-encrypted for him.
• Contrast with Traditional Wrapping: Unlike key-wrapping approaches where a symmetric key is encrypted for each recipient, PRE does not require the data owner to be online to perform the wrapping.
• Example: A researcher's standard PGP key can decrypt a dataset that was originally encrypted for a collaborator at a different institution, without any pre-coordination or shared secrets.

Even if the proxy and a delegate collude by sharing all their cryptographic material, they cannot jointly compute the delegator's secret key. This is the strongest security property in modern PRE schemes.

• Mathematical Foundation: This property relies on the hardness of the Discrete Logarithm Problem or Lattice-Based assumptions, ensuring that the re-encryption key leaks no information about the original secret.
• Type Distinction: Schemes are classified as CPA-secure (Chosen-Plaintext Attack) or CCA-secure (Chosen-Ciphertext Attack) against collusion, with CCA being the gold standard for production systems.
• Enterprise Impact: A cloud provider (proxy) and a terminated employee (delegate) cannot work together to recover the company's master decryption key, preserving zero-trust security postures.

This property defines how many times a ciphertext can be re-encrypted sequentially. Single-hop PRE allows one transformation (A→B), while multi-hop PRE allows chains (A→B→C).

• Single-Hop Advantages: Simpler constructions with stronger security proofs and better performance. Suitable for most enterprise file-sharing and access control scenarios.
• Multi-Hop Complexity: Requires more complex cryptographic machinery, often incurring larger ciphertext sizes that grow linearly with each hop.
• Practical Guidance: Single-hop suffices for the vast majority of use cases. Multi-hop is reserved for complex, multi-layered data pipeline scenarios where data must traverse several processing enclaves.

A cryptographic method enabling computation directly on ciphertext. The proxy in PRE performs a key-switching operation, which is a specific, limited form of homomorphic evaluation. Unlike general HE, the proxy is restricted to a single transformation function—re-encrypting a ciphertext from one public key to another—without ever seeing the plaintext or enabling arbitrary computation.

A public-key encryption scheme where ciphertexts embed an access policy and user keys are associated with attributes. PRE extends this paradigm by allowing a semi-trusted proxy to dynamically re-encrypt data for new attribute sets without the original encryptor being online. This enables revocation and delegation in encrypted access control systems where CP-ABE alone would require re-encryption by the data owner.

A protocol distributing computation across multiple parties where no single party sees the others' private inputs. PRE complements SMPC by efficiently handling the input distribution phase: a data owner can encrypt data once under their own key, and a proxy transforms it for delivery to specific computation nodes without the owner participating in the multi-party protocol or decrypting the data first.

A class of post-quantum cryptographic constructions based on hard problems on high-dimensional lattices, such as Ring Learning With Errors (RLWE). Modern PRE schemes are increasingly built on lattice assumptions to resist quantum attacks. These constructions provide collusion resistance, preventing a proxy and a delegatee from combining their keys to recover the delegator's full private key—a critical security property absent in early bilinear-pairing-based PRE.

A primitive allowing a server to search encrypted data without decryption. In an encrypted vector database architecture, PRE and SSE work in tandem: SSE enables private keyword or token queries over encrypted indexes, while PRE handles the secure delegation of the retrieved encrypted results to authorized querying parties without exposing the master encryption key to the database server.

A protocol where a prover convinces a verifier of a statement's truth without revealing the underlying witness. ZKPs can be integrated with PRE to provide verifiable re-encryption: the proxy generates a succinct proof that the transformation was performed correctly—converting ciphertext under key A to ciphertext under key B—without revealing either key or the plaintext. This prevents a malicious proxy from substituting ciphertext.