Hot answers tagged

6

For starters: Paillier and RSA are based on very similar assumptions, and both systems would be broken immediately by an algorithm to factor large composites. Additionally, knowing $\phi(n)$ or $\lambda(n)$ is quite essential to both systems, because the trapdoor for decryption is based on that. As you can see, the relation to RSA is quite close, and thus ...


5

Sure there's a difference between Paillier and ElGamal as opposed to lattice-based cryptography regarding quantum attackers. Paillier's security is broken as soon as you can efficiently factor large integers which is "easy" using Shor's algorithm. This is caused by the fact that you can easily recover the private from the public key by factoring $n$. ...


5

I'm not sure if I understand what you are asking, so I'll clarify what I am about to answer. We are given two ciphertexts and we want to know if they encrypt the same plaintext or if they encrypt different plaintexts, and we want to do this without revealing anything but this fact. Then, using the additive homomorphism, it's possible to compute $c=enc(r\...


5

Because each time you encrypt a message $m$, its ciphertext changes and is not the same (each time you encrypt you pickup a random element $z \leftarrow \mathbb{Z}_n^*$). If for each message there was the same ciphertext then the encryption scheme would be deterministic and would not be semantically secure or would not provide indistinguishability.


5

No, or at least, if you can, you have an Extremely Significant result; you've just shown that Paillier is a Fully Homomorphic system, and so it could perform any operation on encrypted data (and in a way that's significantly more efficient than any other known FHE system). Here's why: The $|a - b|$ operation is effectively an $XOR$; if the ciphertexts $a, b$...


4

Yes, for example CryptDB uses the Paillier cryptosystem to implement homomorphic encryption for columns that require it. See CryptDB: Protecting Confidentiality with Encrypted Query Processing (pdf) for a description. Whether you consider that use "effective" is another matter. Earlier this month there was a back and forth between the CryptDB developers and ...


3

As user curious said in a other answer probabilistic means that the encryption of the same plaintext under the same key gives as output a different ciphertext. This is a more general property and it is known as a basic security property: it is usually refered to as semantically secure or indistinguishability (roughly: an attacker cannot guess which one of ...


3

With version 1, you are essentially using an additively homomorphic substitution cipher. I understand that the database is quite large, but the number of different values small. This (typically) means that statistical analysis can be used to derive a lot of information, especially if the attacker has some auxiliary information which is often the case. This ...


3

Actually, computing the inverse modulo $n^2$ using (say) the Extended Euclidean method is exactly what you do. If $c = g^m r^n \bmod n^2$ is an encrypted version of $m$, then $c^{-1} = (g^m r^n)^{-1} = g^{-m} (r^{-1})^n$ is a representation of $-m$ (because if $r \in \mathbb{Z}^*_n$, so is $r^{-1}$) That $enc(m) * enc(-m)$ isn't precisely 1 isn't relevant; ...


3

If the parties do exactly what you have described, then yes, the malicious server can learn some information. In particular, if $h_1 == h_2$, then $c_D == c_E$. So, given the $c$ values, the malicious server can learn whether or not $h_1 == h_2$. Furthermore, the malicious server can learn if either $h$ value is $1$, as $c$ would not change. Finally, if the $...


2

It can not do multiplication in the plaintext domain using two ciphertexts. In other words, given $E(m_1)$ and $E(m_2)$, you can not get $E(m_1\cdot m_2)$. You can only get $E(m_1+m_2)$. Given $E(m_1)$ and $m_2$, you can get $E(m_1\cdot m_2)$ however. But notice that $m_2$ in this case was not encrypted. On the site you reference, $C$ is not encrypted. It ...


2

There is no way to know what the authors of that paper even did. They say they used Python, but mention no libraries. If it is their own implementation of those algorithms in Python, it may tell you next to nothing of the real world performance of optimized implementations those algorithms. Further, they say they encrypted files of 68-235 KB, but do not ...


1

Let $c_a$ be the encrypted version of $a$, and $c_b$ be the encrypted version of $b$. What you want to compute is $c_c$ which is the encrypted version of $a-b$, so that when you decrypt $c_c$ you get $c=a-b$. Paillier supports a homomomorphic addtion of ciphertexts to get an encrypted version of the sum. The actual mathematical operation it takes to get ...


1

What you're missing is the fact that your $c$ value can get waaay beyond what the library is expecting there and thus issues an error which can be read as "your value is too large". The solution is simple: Reduce the multiplication result $\bmod N^2$, where $N=pq$ is the actual value of your modulus. The code-line which you would need to add there would ...


1

I do not think what you want is possible with any simple solution - by simple, I mean computationally less expensive than downloading and decrypting all the ciphertexts. Basically, multiplicative homomorphism allows you to check some algebraic "OR": if there is a single 0, then the product of all the plaintexts will be 0. Additive homomorphism, on the other ...


1

With Damgard-Jurik, not only expansion factor is decreased: this scheme improves state of the art. Reducing size of prime factors makes better chance of factoriation or maybe solving particular decision problem that Paillier scheme depends on.


1

Does the limited range of the values, makes cracking the Paillier cryptosystem easier? That depends. I'm assuming that you are generating good, large random $r$ values, just reusing them for the same plaintexts. The main problem with this is that you loose semantic security. It however does not lead to a key leakage attack (AFAIK). So, your question is ...


1

No, this is not possible. The homomorphism only works at one layer. A ciphertext in Paillier is $g^m\cdot r^n\bmod{n^2}$. The plaintext space is the multiplicative group of integers modulo $n$. So, for it to even have a chance to work, first of all, the modulus of the outer encryption would have to be greater than $n^2$, where $n$ is the modulus of the ...



Only top voted, non community-wiki answers of a minimum length are eligible