Abstract. This exposition paper suggests a new low-bandwidth publickey encryption paradigm. The construction turns a weak form of key privacy into message privacy as follows: let E be a public-key encryption algorithm. We observe that if the distributions E(pk0,