First, this a different take on my previous question: Pailler encryption of small integers to 32-bit integers
I have to encode small integers (range 0-50) using the Paillier cryptosystem. Those values will be encountered many times (100,000) in my dataset.
I encode each of this 51 numbers with different
r and therefore I get 51 different ciphertexts. The advantage of this method is that each time any ciphertexts are multiplied, e.g.,
MOD(c(1)*c(2),n2) I always get the same product.
The attacker knows that the range is small (<100) but looking at the 51 different ciphertext values, he can now guess that the range is
0-50 (0 is necessarily the smallest value). Does this make possible for him to actually get the plain texts from the ciphertexts?
For each time one of these numbers are encountered in my dataset, I use different
r. Therefore I now have
100,000*51 ciphertexts. Now it is impossible for the attacker to actually get the plain texts from the ciphertexts. But the problem is that each time any ciphertexts are multiplied
MOD(c(1)*c(2),n2) I do not always get the same product [the plain texts 1 and 2 are encoded multiple times with different ciphertexts], although those different products will always decrypt to the same sum of plain texts.
Obviously, version 2 is more secure. But I would rather use version 1 for its simplicity and easier processing. Does the limited range of the values, makes cracking the Paillier cryptosystem easier?
Let's put an intermediate version. For each value in [0,50] I use up to 10 (or more) different random values of r per value. Meaning that for plain text 0, I will get up to 10 ciphertexts. Overall, 51 plain texts => 510 ciphertexts. This should somehow limit the problems of version 1, without blowing up entirely.