Server-Supported Decryption for Mobile Devices.

We propose a threshold encryption scheme with two-party decryption, where one of the keyshares may be stored and used in a device that is able to provide only weak security for it. We state the security properties the scheme needs to have to support such use-cases, and construct a scheme with these properties. Our construction is based on the ElGamal cryptosystem, with additional zero-knowledge proofs that can provide IND-CCA security, and resistance to offline guessing attacks.