# Calculating ciphersize of Paillier, SSE and OPE

If I have to encrypt a 32 bit plaintext in each of Paillier, SSE and OPE, how can I make an estimate of the ciphertext sizes respectively in order to reserve the amount of space in a database?

How to know how much space to reserve? There are two ways:

1. Take an implementation of the scheme, encrypt a 32-bit plaintext, and see how long the resulting ciphertext is. This is the simplest approach.

2. Understand the scheme at a conceptual level, and then use your understanding of the algorithm to predict how long the ciphertext will be.

Since it sounds like you don't understand the schemes at a conceptual level, my recommendation is that you use the first approach.

Note that your question does not provide enough information to answer your question completely. Here's what I can tell you, given the information in your question:

• Paillier. Suppose you want security equivalent to that of 2048-bit RSA (a reasonable level of security; anything much shorter won't be very secure). Then Paillier ciphertexts will be 4096 bits wide: twice the length of the length of $n$. That's because a Paillier ciphertext is a number $c$ modulo $n^2$ (i.e., $c$ is between $1$ and $n^2-1$). Even if you just want to encrypt a 32-bit plaintext, the ciphertext will still be 4096 bits long. I know, that is a downside, but that's just the way it is.

• OPE. Order-Preserving Encryption (OPE) is not a single scheme; it is a goal for a scheme. It's like the difference between "RSA" vs "public-key encryption"; the former is a scheme, the latter is a goal. OPE is analogous to "public-key encryption", not to "RSA". Therefore, I can't tell you how long the ciphertexts will be if you use OPE, because the length of the ciphertexts will depend which OPE scheme you use, and there are many proposed schemes for OPE.

• SSE. I don't know what the acronym SSE refers to. If SSE refers to Searchable Symmetric Encryption, then there's a similar situation: we can't tell you how long the ciphertext will be, because there are many SSE schemes out there, and without knowing which of those schemes you are intending to use, we can't tell you how long the ciphertexts will be.

All in all (and not looking at the multitude of possible, individual implementations), I would say that you should be somewhat "OK" if you reserve about twice the size of the plaintext, to store your ciphertext in a database. In your case, expect 32 bit plaintext * 2 = 64 bit ciphertext — at least.

• Comments are not for extended discussion; this conversation has been moved to chat. – e-sushi Dec 17 '17 at 13:02