proxy-recrypt

Unidirectional proxy re-encryption for Python. proxy-recrypt wraps the JHU-MIT Proxy Re-encryption Library (proxylib) — the reference implementation of the AFGH "PRE1" scheme (Ateniese, Fu, Green, Hohenberger — NDSS'05) over the MIRACL pairing library — and adds a Pythonic high-level API plus a hybrid (KEM/DEM) layer so you can encrypt data of any size: Alice encrypts once, hands a re-encryption key to a semi-trusted proxy, and the proxy transforms her ciphertexts so Bob can decrypt them — without the proxy ever seeing plaintexts or secret keys.

Install

Linux x86-64 only. Requirements: g++, ar, Python ≥ 3.9 with setuptools and the CPython development headers.

./build_native.sh      # builds miracl.a + proxylib.a (with -fPIC) and the extension
python -m pip install .

build_native.sh also leaves an in-place build in proxy_recrypt/, so the tests and example run from the source tree without installing:

python3 tests/test_proxy_recrypt.py    # or: pytest tests/test_proxy_recrypt.py
python3 example/example.py

If Python.h is not in your compiler's default include path, either export CPATH (e.g. export CPATH=$HOME/.local/include/python3.12) before building, or place the headers in ~/.local/include/pythonX.Y/ — setup.py picks that directory up automatically. The high-level hybrid API depends on cryptography (installed automatically by pip install .).

Quick start

import proxy_recrypt as prc

# One-time setup: parameters shared by all users.
params = prc.generate_params()

alice_pk, alice_sk = prc.generate_keypair(params)
bob_pk, bob_sk = prc.generate_keypair(params)

# Alice encrypts data of any size for herself:
#   capsule = tiny re-encryptable encryption of a fresh 32-byte data key
#   payload = AES-256-GCM encryption of the data under that key
data = b"any amount of data" * 10_000
capsule, payload = prc.encrypt_data(params, alice_pk, data)

# Alice delegates to Bob: the proxy gets this key (works Alice->Bob only).
rekey = prc.generate_reencryption_key(params, bob_pk, alice_sk)

# The proxy transforms ONLY the capsule; the payload is untouched.
capsule_bob = prc.reencrypt_capsule(params, capsule, rekey)

# Bob decrypts with his own secret key.
assert prc.decrypt_data(params, bob_sk, capsule_bob, payload) == data

Short messages (≤ 63 bytes) can skip the hybrid layer: encrypt_message(params, pk, msg, level=2) / reencrypt(params, ct, rekey) / decrypt_message(params, sk, ct).

Everything serializes to bytes: params.to_bytes(), pk.to_bytes(), sk.to_bytes(), ct.to_bytes() with matching *_from_bytes() functions; re-encryption keys, capsules and payloads already are bytes. In a fresh process, always load CurveParams first.

API

High-level

Low-level (mapping to proxylib)

Errors: bad arguments and malformed serialized data raise ValueError; proxylib failures raise RuntimeError; GCM authentication failures (tamper, wrong key, aad mismatch) raise cryptography.exceptions.InvalidTag; an RNG seeding failure at import raises ImportError.

Caveats

• Legacy parameters. proxylib (2007) uses a 512-bit prime-field pairing curve with a 160-bit group order — far below current security recommendations for pairing-based crypto. Treat this package as a research and prototyping tool, not production-grade cryptography.
• Not wire-compatible with the JavaScript proxy-recrypt package. The hybrid capsule/payload structure mirrors it, but the curve, ciphertext serialization and KDF differ, so blobs cannot be exchanged between the two.
• Direct-message encoding. encrypt_message plaintexts are encoded as big integers, so leading b"\x00" bytes are not preserved by decrypt_message (the hybrid API is not affected).
• Single parameter set per process; not thread-safe. MIRACL/proxylib keep the active curve and scratch state in globals — use one CurveParams at a time and keep all calls on one thread.
• License. proxylib is published for research and non-commercial use (see the headers in external/proxylib/); this package inherits those constraints.