The disclosure is directed to a proxy re-encryption scheme with limited delegations. To generate a formula (I) ciphertext for a message, wherein formula (II) is an integer, a (I) ciphertext enabling formula (IV) levels of re-encryption and L-1 is a maximum number of possible re-encryption levels, a processor (112) generates, in a (I) group of prime order p, a (I) encryption key for the (I) ciphertext from a public key and a (I) generator for the (I) group; obtains a first ciphertext component by multiplying the message with a generator of a final group formula (III) of a multi-linear configuration with L levels, the generator being raised to the power of an integer exponent; obtains a second ciphertext component by taking the (I) encryption key to the power of the integer exponent; and outputs the (I) ciphertext comprising the integer (II), the first ciphertext component and the second ciphertext component. In a preferred embodiment, the processor (112) includes an indicator of a time period in the (I) ciphertext; and, if the integer (IV), obtains a third ciphertext component by taking a hash value over the time period to the power of the integer exponent and includes the third ciphertext component in the (I) ciphertext that is output. Also provided are the re-encryption and decryption counterparts.