title: How to hidden Umbral Key
body: <p>As umbral-doc define
  <a href="https://i.stack.imgur.com/z3OXf.png" rel="nofollow noreferrer">Main operation of Umbral KEM</a></p>
  <ol>
  <li>Alice use public Key encapsulaition, the K (key used for chacha20 encrypt) was genrated.</li>
  <li>ReEncryption for shared to bob.</li>
  <li>Final, Bob use privateKey get K and cipherText, decrypt cipherText get plainText.</li>
  </ol>
  <p>My Question is:<br />
  <strong>Final, Bob get <em>decrypt Key</em>,  so next time Bob can use <em>decrypt Key</em> decrypt cipherText without gather cFrags, also can send key to other(like clark), How to keep the secret.</strong></p>
  <p>The umbral program guide like:</p>
  <pre class="lang-py prettyprint-override"><code>from umbral import pre, keys, signing
  
  # Generate Umbral keys for Alice.
  alices_private_key = keys.UmbralPrivateKey.gen_key()
  alices_public_key = alices_private_key.get_pubkey()
  
  alices_signing_key = keys.UmbralPrivateKey.gen_key()
  alices_verifying_key = alices_signing_key.get_pubkey()
  alices_signer = signing.Signer(private_key=alices_signing_key)
  
  # Generate Umbral keys for Bob.
  bobs_private_key = keys.UmbralPrivateKey.gen_key()
  bobs_public_key = bobs_private_key.get_pubkey()
  
  # Generate Umbral keys for Clark.
  clarks_private_key = keys.UmbralPrivateKey.gen_key()
  clarks_public_key = clarks_private_key.get_pubkey()
  
  # Encrypt data with Alice's public key.
  plaintext = b'Proxy Re-Encryption is cool!'
  ciphertext, capsule = pre.encrypt(alices_public_key, plaintext)
  
  # Decrypt data with Alice's private key.
  cleartext = pre.decrypt(ciphertext=ciphertext,
                          capsule=capsule,
                          decrypting_key=alices_private_key)
  
  # Alice generates &quot;M of N&quot; re-encryption key fragments (or &quot;KFrags&quot;) for Bob.
  # In this example, 10 out of 20.
  kfrags = pre.generate_kfrags(delegating_privkey=alices_private_key,
                               signer=alices_signer,
                               receiving_pubkey=bobs_public_key,
                               threshold=10,
                               N=20)
  
  
  capsule.set_correctness_keys(delegating=alices_public_key,
                               receiving=bobs_public_key,
                               verifying=alices_verifying_key)
  
  cfrags = list()           # Bob's cfrag collection
  for kfrag in kfrags[:10]:
      cfrag = pre.reencrypt(kfrag=kfrag, capsule=capsule)
      cfrags.append(cfrag)    # Bob collects a cfrag
  
  for cfrag in cfrags:
      capsule.attach_cfrag(cfrag)
  
  bob_cleartext = pre.decrypt(ciphertext=ciphertext,
                              capsule=capsule,
                              decrypting_key=bobs_private_key)
  assert bob_cleartext == plaintext
  
  print(bob_cleartext)
  </code></pre>