Abstract: In an escrowable public key encryption (E-PKE) scheme, there are two keys associated with one public key. It can reduce the total number of certificates in the public key infrastructure (PKI) to a large extent, thus degrade the complexity of certificate management. Moreover, an E-PKE scheme can also reduce the key storage for end users. Two such schemes were proposed, with the second one being the most efficient one among all existing E-PKE schemes. It is also the first provably secure E-PKE scheme, whose security is based on the standard bilinear Diffie-Hellman (BDH) assumption.