Comments on “Unidirectional Chosen-Ciphertext Secure Proxy Re-Encryption”

Libert and Vergnaud proposed a unidirectional proxy re-encryption scheme with temporary delegation (IEEE Trans. Inf. Theory, vol. 57, no. 3, pp. 1786–1802, Mar. 2011). They claimed that the scheme is chosen ciphertext secure in the chosen key model. However, their proof has a minor error in the simulation of the re-encryption oracle. The adversary is able to distinguish between the simulated environment and the real attack environment by using responses from the re-encryption oracle. Fortunately, we can amend the proof without any modification of the original scheme.