6
$\begingroup$

I am trying to understand what are the benefits of using Damgård–Jurik over Paillier. I understand that expansion factor decreases as s increases. But isn't it the case that this comes at the expense of security? If your goal is to reduce space overhead compared to Paillier then you might choose a smaller security parameter and a higher value for s. Or to put it otherwise for a fixed security parameter as s increases cipher-text size increases. So why not just use Paillier with a smaller security parameter?

$\endgroup$

1 Answer 1

2
$\begingroup$

With Damgård-Jurik, not only expansion factor is decreased: this scheme improves state of the art.

Reducing size of prime factors makes better chance of factoriation or maybe solving particular decision problem that Paillier scheme depends on.

$\endgroup$
2
  • $\begingroup$ Are you suggesting that there is a way to reduce cipher text space overhead in DJ without reducing the size of prime factors (which is what i refer to as security parameter)? Could you give an example? $\endgroup$
    – savx2
    Dec 9, 2015 at 21:00
  • 1
    $\begingroup$ DJ did not claim any overhead, right? They claimed expansion factor. I'm suggesting against reducing bitsize of primes (security parameter), that results in decreasing hardness of factoring. Increasing $s$ will not make factoring any harder. $\endgroup$ Dec 9, 2015 at 21:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.