![](bg2.png)
G.Ateniese, 2007) has been proposed as this type.
Green and Ateniese proposed the [IBE-PKE]-type
scheme in (M.Green and G.Ateniese, 2007); however
their scheme has following drawbacks.
1. The size of the re-encrypted ciphertext increases
as compared to that of the original ciphertext.
2. The decryption algorithm of the re-encrypted ci-
phertext is different from the original decryption
of the PKE scheme.
[IBE-IBE] type and [PKE-PKE] type of proxy
re-encryption schemes have been proposed without
such drawbacks. One of the theoretical interests is
to construct the [IBE-PKE]-type proxy re-encryption
scheme which does not have such drawbacks.
1.1 Entities of Proxy Re-Encryption
Generally, proxy re-encryption schemes have the fol-
lowing entities.
Sender. This entity encrypts plaintexts using a dele-
gator’s public key.
Delegator. This entity possesses the secret key cor-
responding to the public key used by the sender,
and delegates decryption rights.
Delegatee. The decryption rights delegates to this en-
tity from the delegator. The delegatee can decrypt
re-encrypted ciphertexts own secret key, and with-
out the delegator’s secret key.
Proxy. This semi-trusted entity re-encrypts cipher-
texts with a re-encryption keys, and outputs the
ciphertexts, which the delegatee can decrypt us-
ing his own secret key without revealing underly-
ing the plaintexts.
In [IBE-IBE], [IBE-PKE] and [PKE-IBE] type
schemes have an additional entity PKG (Private Key
Generator), which generates IBE secret keys. In our
schemes this trusted entity take a part of re-encryption
key generation.
Sender
Delegator Proxy Delegatee
PKG
?
H
H
H
H
H
H
Hj
-
9
encrypts
decrypts re-encrypts decrypts
Figure 1: Entities of proxy re-encryption.
1.2 Security of Proxy Re-Encryption
With regard to the security of proxy re-encryption
schemes Green and Ateniese pointed out the previ-
ous schemes achieve a security only for chosen plain-
text attacks (CPA), and also proposed a new scheme
achieves chosen ciphertext attacks (CCA) security in
(M.Green and G.Ateniese, 2007).
Green and Ateniese described that in the previous
schemes, proxy cannot verify ciphertexts and grant
adversaries invalid re-encryption. Hence, malicious
delegatee can use a re-encryption oracle as a decryp-
tion oracle. Furthermore they proposed CCA-secure
scheme with random oracle model using Canetti,
Halevi and Kats (CHK) (R.Canetti et al., 2004) tech-
nique, which enables the proxy to validate cipher-
texts.
After Green and Ateniese pointed out the se-
curity problems with the previous schemes, Canetti
and Hohenberger proposed CCA-secure [PKE-PKE]-
type Re-Encryption scheme in the standard model
(R.Canetti and S.Hohenberger, 2007).
In this paper, we propose a new [IBE-PKE]-type
scheme, which achieves CPA-security only. How-
ever it might be possible achieve CCA-security us-
ing Green and Ateniese technique in (M.Green and
G.Ateniese, 2007).
1.3 Our Contribution
We propose the first [IBE-PKE]-type proxy re-
encryption scheme, which holds the following advan-
tages simultaneously.
• Our scheme achieves optimal ciphetext size. The
size of a re-encrypted ciphertext is same as a
PKE ciphertext, while (M.Green and G.Ateniese,
2007) [IBE-PKE]-type scheme requires addi-
tional elements of ciphertext to support re-
encryption.
• Our scheme achives proxy invisibility which
means delegatee does not require additional algo-
rithm for decryption of a re-encrypted ciphertext.
The delegatee can decrypt ciphertexts without be-
ing aware of the existence of the proxy, while it is
required in (M.Green and G.Ateniese, 2007).
• Our scheme is selective-ID secure in the standard
model, while previous [IBE-PKE]-type scheme in
(M.Green and G.Ateniese, 2007) might be full-ID
secure in the random oracle model. Furthermore
our scheme might be possible to extend full-ID
secure using IBE proposed in (B.Waters, 2005).
• In Our scheme the PKG generates re-encryption
keys, while (M.Green and G.Ateniese, 2007) del-
SECRYPT 2008 - International Conference on Security and Cryptography
286