Applications of Group Ciphers I've been reading a paper [1], and I've ran across something called a "Group Cipher", which is similar to homomorphic encryption, with an important difference.

In homomorphic encryption we have an encryption operation $E_k: P \rightarrow C$, where $P$ is the set of plain texts and $C$ is the set of cipher texts. We also have an efficient group operation on $C$ that induces a homomorphism to the group operation on $P$.

The difference with Group Ciphers is that the group operation on $C$ is composition of encryption $E$, and it induces a homomorphism on the group operation of the set of keys $K$. That means, if we denote an encryption of a plain text $X$ as ${X}_i$, then we would have that ${ { X }_i }_j = { X }_{i \circ j}$.

In the paper they use it to do something like asymmetric encryption, but using symmetric encryption. They do need a semi-trusted third party.

For example, Alice's key is $i$, Bob's key is $j$. Ted has the key $i^{-1} \circ j$.

Alice will encryption something : ${X}_i$. Send it to Ted, who will then encrypt it again : ${ {X}_i }_{i^{-1} \circ j}$ , which will yield ${X}_j$, then Ted send it to Alice again. After that Alice sends it to Bob. Bob can then decrypt it.

What happened here is that Alice can send to Bob, without knowing bob's (symmetric) key. And Bob can decrypt without knowing Alice's (symmetric) key. Just like asymmetric encryption. But using symmetric encryption instead (and a semi-trusted third party).

They also prove that the Pohlig-Hellman cipher has this property.

The question is:


  1- Does Group Ciphers have any other applications in the literature (with references) ?
  
  2- What are the drawbacks of this scheme compared to asymmetric encryption (other than the required semi-trusted third party) ? 


(I was not sure of which tag to use for this question.)

1 S. M. Bellovin and W. R. Cheskwick (2004). "Privacy-Enhanced Searches Using Encrypted Bloom Filters". Draft.
What they are calling a "group cipher" is much more commonly referred to as proxy re-encryption. Proxy re-encryption is typically asymmetric but I don't think there is anything prohibiting it being symmetric. It has many applications (see this list) but most of these applications are using the asymmetric variants. I myself cannot point to another application of symmetric proxy re-encryption.

One drawback is that it is almost as expensive as an asymmetric scheme, so there is little reason to prefer it with today's computational abilities. 

Another is that it requires a small multi-party computation between the three parties so that the third party learns the ratio key without Alice or Bob learning it, or the third party learning anything other than it. This MPC requires secure channels, which for all scenarios where at least one pair of parties haven't exchanged keys in-person, this means using asymmetric cryptography to setup the channels.