# Tag Info

1

Let $c_a$ be the encrypted version of $a$, and $c_b$ be the encrypted version of $b$. What you want to compute is $c_c$ which is the encrypted version of $a-b$, so that when you decrypt $c_c$ you get $c=a-b$. Paillier supports a homomomorphic addtion of ciphertexts to get an encrypted version of the sum. The actual mathematical operation it takes to get ...

1

What you're missing is the fact that your $c$ value can get waaay beyond what the library is expecting there and thus issues an error which can be read as "your value is too large". The solution is simple: Reduce the multiplication result $\bmod N^2$, where $N=pq$ is the actual value of your modulus. The code-line which you would need to add there would ...

1

I think your proof of correctness may be hampered by the fact that you are setting the ciphertext to $(c_0, c_1) = (a, as + 2e + m)$ when in fact the paper you cite sets the ciphertext to $(c_0, c_1) = (as + 2e + m, -a)$. You correctly state that decryption is then computed as $c_0 + c_1s \text{ (mod } 2)$. This reduces to $(as + 2e + m) + (-a)s \text{ (mod }... 3 This is somewhat a paradox. It seems that if the server cannot know when equality is reached, how can it return only those documents. Surprisingly, it can be done, under the assumption that an upper bound is given on the number of documents (and at the cost of that upper bound). Assume first that only one document matches, and this is known. Denote by${\...

1

I do not think what you want is possible with any simple solution - by simple, I mean computationally less expensive than downloading and decrypting all the ciphertexts. Basically, multiplicative homomorphism allows you to check some algebraic "OR": if there is a single 0, then the product of all the plaintexts will be 0. Additive homomorphism, on the other ...

4

I'm not sure if I understand what you are asking, so I'll clarify what I am about to answer. We are given two ciphertexts and we want to know if they encrypt the same plaintext or if they encrypt different plaintexts, and we want to do this without revealing anything but this fact. Then, using the additive homomorphism, it's possible to compute $c=enc(r\... 6 I've spoken to the CEO a couple times. They've contracted some prominent French cryptographers to vet their cryptosystem, but no security analysis or whitepaper has been released. Their KFHE scheme is different than previous schemes because it uses a different hardness assumption that leads to better performance and smaller keys. Previous FHE schemes used ... 0 On the paper Low Depth Circuits for Efficient Homomorphic Sorting (page 5), the authors present circuits to homomorphically evaluate comparisons. Their "Less Than Circuit" compares$\ell$-bit integers in the following way: They define a bit level "less than":$f(x, y) = y \cdot (x + 1) \mod 2$(where$x$and$y\$ are encryptions of bits). They define a ...

Top 50 recent answers are included