mRSA Encryption.

The encryption process is identical to that in standard RSA. (In other words, ciphertext is computed as $c=m^{e_i} \;(\bmod n_i)$ where m is an appropriately padded plaintext, e.g., using OAEP.) Decryption, on the other hand, is very similar to signature generation above.

• 1. upon obtaining an encrypted message c, user U_i sends it to the appropriate SEM.
  • - SEM checks that U_i is not revoked and, if so, computes a partial cleartext $PC_{sem}=c^{d_i^{sem}} \; (\bmod n_i)$ and replies to the user.
  • - concurrently, U_i computes $PC_u=c^{d_i^u} \; (\bmod n_i)$.
• 2. U_i receives PC_sem and computes $c'=(PC_{sem}*PC_u)^{e_i} \; (\bmod n_i)$. If c'=c, the cleartext message is: (PC_sem*PC_u)=c^d_iu.