Re-encryption without knowing the secret Which encryption algorithms could be used for the following scenario?


A user stores a file encrypted by someone else
Then the user is asked to re-encrypt the file with a new secret
The user stays unaware about the clear text every moment


To achieve that the user can be provided with a kind of "diff" secret, I suppose. It may be a password based algorithm.
This is possible with the Integrated Encryption System

In this system, there are global values $p$ (a large prime) and $g$ (a generator of a prime subgroup in $\mathbb{Z}_p^*$).  A private key is a value $x$ and the corresponding public key is the value $y = g^x \bmod p$.

To encrypt a message $M$ using the public key $y$, you select a random value $r$, and publish the pair $(C, D)$ with $C = g^r \bmod p$ and $D = E_{y^r \bmod p}( M )$ (where $E_k(M)$ is the message $M$ encrypted using the key $k$ with some symmetric cipher).

To decrypt a message $(C, D)$ using the public key $x$, you just compute $C^x \bmod p$; this is the value $y^r \bmod p$, which you can then use as the key for the symmetric cipher in $D$.

Now, here comes the interesting part; to update the key from $x$ to $x'$, what the holder of the private key would do is compute $s = x x'^{-1} \bmod p-1$; he then sends it to the user.  The user then replaces $(C, D)$ with $(C^s \bmod p, D)$

We can see that the updated ciphertext $(C^s \bmod p, D)$ is a valid ciphertext to the new public key $y' = g^{x'} \bmod p$; the decryption computes $(C^s)^{x'} = C^{x}$, which is the same key that was originally used to encrypt D, hence decryption works as expected.