A public-key cryptosystem invented by Pascal Paillier in 1999.

learn more… | top users | synonyms

0
votes
2answers
65 views

Pailler encryption of small integers to 32-bit integers

I want to encrypt very small integers in the range 0-44 using the Paillier cryptosystem. Is there a way to select p, ...
3
votes
2answers
94 views

Does the Paillier system remain secure if it is used to encrypt only binary values, i.e. {0, 1}?

Is there any security compromises if the Paillier system was used to encrypt only binary message in {0, 1}? i.e., plaintexts are either 0 or 1.
1
vote
0answers
78 views

Paillier Encryption: problems with double encryption

Given have two public keys $k1$ and $k2$, $E_{k1}(E_{k2}(m_1))$ and $m_2$. Is it possible to calculate $E_{k1}(E_{k2}(m_1 + m2))$? (or with multiplication instead of addition) At a first glance, I ...
3
votes
1answer
70 views

Paillier cryptosystem preserve ordering of sums for two integer sequences

According to Paillier cryptosystem the product of two ciphertexts will decrypt to the sum of their corresponding plaintexts. I have two separate integer sequences X and Y that have same number of ...
2
votes
0answers
81 views

Proving that a plaintext is the Paillier decryption of a certain ciphertext

Assume that Alice received 100 ciphertexts encrypted with additive homomorphic encryption, say Paillier, using the same public key that belongs to Bob. Alice added all of them, and wants to know the ...
2
votes
2answers
91 views

Formal security of recycled random blinding in a Paillier scheme

This question is a follow-up/variant on a previous question. Supposing that we are trying to generate a large number of (indistinguishable) ciphertexts of a given plaintext and want to avoid the ...
1
vote
1answer
65 views

How bad would it be to reuse the random blinding factor in a scheme like Paillier?

A secure and somewhat fast way to "re-encrypt" (refresh? anonymise?) a Paillier ciphertext, $c$, is to multiply it by an exponentiated random value: $c \gets c \cdot r^n \mod n^2$ (with $r \in ...
1
vote
1answer
149 views

Performance bottlenecks in Paillier encryption

I'm implementing Paillier encryption and I'd like some recommendations about improving its performance. Firstly, I have to note the following: I have already set g=1+n to get rid of one ...
-3
votes
1answer
197 views

can anyone give the java code to encrypt files using paillier [closed]

I want to implement encryption on personal files using paillier encryption. Is it possible to encrypt files using this encryption..
1
vote
0answers
125 views

RSA or Paillier is good? [closed]

I want to implement file storage in cloud using homomorphic encryption. I want to use paillier encryption. Can you suggest the drawback of RSA to store and retrieving the files. Then only i can use ...
0
votes
0answers
40 views

Mistakes in Jarecki-Liu use of Camenish-Shoup encryption?

I am implementing a protocol that uses Jarecki-Liu OPRF, which itself uses a simplification of Camenish-Shoup Encryption. Description of the way they do Camenish-Shoup is in section 2.3 of ...
1
vote
1answer
62 views

Is equal length of primes in Paillier cryptosystem is mandate for security reasons?

In continuation to this question about length of primes , I am in doubt about the restriction on length of primes itself . In Paillier cryptosystem , equal length of primes are used . My doubt is ...
1
vote
1answer
124 views

How can I do minus on plaintexts in the Paillier cryptosystem?

We have $E(a)$, $E(b)$ encrypted under the same Paillier key. As we all know, we can get $E(a+b)$ by calculating $E(a)*E(b)$. But can we get $E(a-b)$, by calculating $E(a)/E(b)$? I tried to ...
1
vote
1answer
178 views

Equal length of primes in paillier cryptosystem

In the key generation step of paillier cryptosystem , In order to satisfy $\gcd(pq,(p-1)(q-1))=1$ , we can take equal length primes. Instead of taking(length as parameter to generate $p,q$) equal ...
1
vote
1answer
130 views

Choosing primes in the Paillier cryptosystem

In the first step of key generation phase in Paillier cryptosystem given here. It's given that ( length($p$) == length($q$) )$\implies$ gcd$(pq,(p-1(q-1)))$=1 where length($k$) = # bits in ...
3
votes
0answers
258 views

Paillier can add and multiply, why is it only partially homomorphic?

I've seen that it's widely accepted that before Gentry's breakthrough (which is not practical yet) in 2009 there were no known full homomorphic encryption scheme. I've read here in another answer ...
2
votes
1answer
468 views

How to select $g$ in Paillier Cryptosystem

For my cryptography class project in university I have selected Paillier Cryptosystem as a course project ...
3
votes
1answer
144 views

Logical OR operation in a homomorphic additive cryptosystem

Suppose we have a cryptosystem homomorphic for addition (say Paillier's). Is there a way to perform a logical OR operation between two binary values (with a binary result). We can, of course, obtain ...
8
votes
1answer
979 views

Homomorphic (encrypted) comparison to an integer

When working with an additive homomorphic encryption scheme (say Pallier's), is there an efficient way to get the encrypted value of a comparison test to an integer value (I realise that an ...
3
votes
2answers
282 views

Calculating ciphersize of Paillier, SSE and OPE

If I have to encrypt a 32 bit plaintext in each of Paillier, SSE and OPE, how can I make an estimate of the ciphertext sizes respectively in order to reserve the amount of space in a database?
-1
votes
1answer
102 views

Paillier Crypto System : Pros and Cons? [closed]

Can you please list the pros and cons of the Paillier crypto system you have encountered or found?
2
votes
1answer
284 views

Bandwidth and block size for Paillier cryptosystem

Can someone clarify what is meant by the terms cryptosystem bandwidth and block size for public key cryptosystems; The context is the Paillier cryptosystem and its Damgard-Jurik generalisation. My ...
2
votes
2answers
289 views

How to verify a number encrypted with an unknown key

Alice and Bob are going to follow the protocol below. Are there any crypto-constructions to help Bob verify the correctness of the answer he gets?: Alice encrypts a set of numbers using some ...
1
vote
1answer
129 views

Security relevance of random factor in Paillier

In the Paillier cryptosystem [1] the encryption of $m \in \mathbb{Z}_N$ with randomness $r \in \mathbb{Z}_n^*$ is $c = g^m r^n \bmod{n^2}$. The additive-homomorphic property of the system shows that ...
2
votes
1answer
299 views

Questions about proof of correct encryption in the Paillier cryptosystem

In the Paillier cryptosystem [1] the encryption of $m \in \mathbb{Z}_N$ with randomness $r \in \mathbb{Z}_n^*$ is $c = g^m r^n \bmod{n^2}$. A proof of correct encryption could look like presented in ...
3
votes
1answer
113 views

How hard are discrete logarithms problems in $\mathbb Z^{*}_{n}$ and $\mathbb Z^{*}_{n^2}$, where $n$ is the RSA $n=pq$

Use the notations form the Wikipedia article Paillier Cryptosystem , assume that the chipertext $c$ and $c^{\lambda} \mod n^2$ are both given, is it possible to compute $\lambda$ easily?
1
vote
1answer
163 views

inverse element in Paillier cryptosystem

As I know, in Paillier cryptosystem, the encryption $c$ of a message $m$ is calculated as $c=g^m r^n \bmod n^2$. Now, I am wondering if I can derive $g^m \bmod n^2$ given that I know $c$, $r$, and ...
2
votes
1answer
444 views

Several questions about Paillier cryptosystem

I have several questions concerning the original Paillier cryptosystem as described in Paillier, Pascal (1999). "Public-Key Cryptosystems Based on Composite Degree Residuosity Classes". EUROCRYPT. ...
0
votes
1answer
295 views

Implementing Paillier Signature Scheme in Delphi

I've been trying to implement the Paillier Signature Scheme in Delphi, but I can't get it to work and I don't know where the problem is. First of all, I got my info about the scheme from this paper. ...
1
vote
1answer
281 views

ZKIP for Paillier public key correctness

I'm using the Paillier cryptosystem in a protocol similar to mental poker. In the beginning of the protocol, each player generates a Paillier public key $(n,g)$. Later in the protocol, a player may ...
5
votes
3answers
961 views

Division in paillier cryptosystem

Is division possible in the Paillier Cryptosystem? i.e. given a the cipher-text $C$ of an integer $M$ the plain-text divisor $D$, and only the public key, can one compute the cipher-text of $M/D$ ?