We describe a public-key encryption system that remains secure even encrypting messages that depend on the secret keys in use. In particular, it remains secure under a "key cycle" usage, where we have a cycle of public/secret key-pairs (pki, ski) for i = 1, . . . , n, and we encrypt each ski under
Dan Boneh, Shai Halevi, Michael Hamburg, Rafail Os