Leakage-deterring encryption for message communication

A system of communicating a message, the system comprising a sender computer, a receiver computer and a decryptor computer each operable for communication via a network, wherein:

• the sender computer stores a public key pko of a recipient key-pair (pko, sko) of a message recipient, a commitment c, bound to the public key pko, to a secret s of the message recipient, and a public key pkt of a decryptor key-pair (pkt, skt);
• the receiver computer stores a secret key sko of said recipient key-pair (pko, sko), said commitment c and an opening o to said commitment;
• the decryptor computer stores a secret key skt of said decryptor key-pair (pkt, skt);
• the sender computer is adapted to encrypt a message m for said message recipient by generating first and second ciphertexts, wherein the first ciphertext encrypts the message m using a randomly-generated message key k and said public key pko of the recipient key-pair and the second ciphertext encrypts an input, comprising said message key k and said commitment c, using a public key pkt of said decryptor key-pair (pkt, skt), and to send the first and second ciphertexts to the receiver computer via the network;
• the receiver computer is adapted, in response to receipt of said first and second ciphertexts, to send the second ciphertext to the decryptor computer via the network and provide to the decryptor computer a proof proving knowledge of said commitment c in the second ciphertext and of said opening o to the commitment;
• the decryptor computer is adapted to verify said proof and, if the proof is verified, to send the message key k, obtained by decrypting the second ciphertext using the secret key skt of said decryptor key-pair, to the receiver computer via the network;
• and
• the receiver computer is further adapted, in response to receipt of the message key k, to decrypt the first ciphertext, using the message key k and the secret key sko of the recipient key-pair, to obtain said message m.