Comments on “Unidirectional Chosen-Ciphertext Secure Proxy Re-Encryption”

Libert and Vergnaud proposed a unidirectional proxy re-encryption scheme with temporary delegation (IEEE Trans. Inf. Theory, vol. 57, no. 3, pp. 1786-1802, Mar. 2011). They claimed that the scheme is chosen ciphertext secure in the chosen key model. However, their proof has a minor error in the simulation of the re-encryption oracle. The adversary is able to distinguish between the simulated environment and the real attack environment by using responses from the re-encryption oracle. Fortunately, we can amend the proof without any modification of the original scheme.