Proxy Cryptography draft available

Matt Blaze posted the following to cryptography/coderpunks.
Looks like potentially cool stuff. I had to use 
ftp://research.att.com/dist/mab/proxy.ps
as a URL, but that may just have been Netcom DNS weirdnesses.

>Subject: Proxy Cryptography draft available
>Date: Tue, 13 May 1997 18:37:10 -0400
>From: Matt Blaze <mab@research.att.com>
>Sender: owner-cryptography@c2.net
>
>I've put a draft of a new paper in my ftp directory.  Comments and
>discussion welcome.  In particular, I'm curious if anyone can find
>any real practical application for symmetric proxy functions.
>
>ftp://ftp.research.att.com/dist/mab/proxy.ps
>
>Proxy Cryptography
>
>Matt Blaze
>Martin Strauss
>
>AT&T Labs -- Research
>{mab,mstrauss}@research.att.com
>
>Abstract:
>
>This paper introduces {\em proxy cryptography,} in which a {\em
>proxy function,} in conjunction with a public {\em proxy key,}
>converts ciphertext (messages in a public key encryption scheme or
>signatures in a digital signature scheme) for one key ($k_1$) into
>ciphertext for another ($k_2$).  Proxy keys, once generated, may
>be made public and proxy functions applied in untrusted environments.
>Various kinds of proxy functions might exist; {\em symmetric} proxy
>functions assume that the holder of $k_2$ unconditionally trusts
>the holder of $k_1$, while {\em asymmetric} proxy functions do not.
>It is not clear whether proxy functions exist for any previous
>public-key cryptosystems.  Several new public-key cryptosystems
>with symmetric proxy functions are described: an encryption scheme,
>which is at least as secure as Diffie-Hellman, an identification
>scheme, which is at least as secure as the discrete log, and a
>signature scheme derived from the identification scheme via a hash
>function.
>
>

#			Thanks;  Bill
# Bill Stewart, +1-415-442-2215 stewarts@ix.netcom.com
# You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp
#     (If this is a mailing list, please Cc: me on replies.  Thanks.)

I had thought about this (proxy crypto) a few weeks ago as an attack.  I
didn't give it much thought, as I'm weak on the math side, and it seemed to
me that it couldn't have been an original idea.

What really worries me is that this proxy function links alot of stuff
together: it links algorithms, it links keys, etc.  If I develop a
supposedly strong system that has a proxy function for another strong
system, then essentially if mine gets broken the other does as well.  Or,
if I recover the key for one system, I can recover the original key from
another system.  The whole situation epitomises the old "A chain is only as
strong as its weakest link" adage.  From a security point of view, this
really doesn't encourage me to include the capability for proxy functions
in any system I should happen to make.  Am I missing something here?
_________ o s b o r n e @ g a t e w a y . g r u m m a n . c o m _________
"Everybody just butt out!  I'm not in love with her!  I'm Die Fledermaus!
 The only person that I'm in love with is me and I'm out of here!" -Die
Fledermaus trying to explain his actions.