Assume $N$ is a public key for paillier encryption, generated by a third party.

Question: Given $N$ can each client generate its own private key, such that its public key is $N$? So all parties separately generate their private key, but their public key is the same.

  • $\begingroup$ This might not directly answer your question (tylo did that already), but if you haven't yet done so, I suggest you to take a look on Distributed Key Generation protocols. I think you might be interested, for instance, on how to generate a public key such that no single party holds the whole private key. $\endgroup$ Sep 9, 2016 at 12:03

1 Answer 1


No, that doesn't work.

If one party chooses primes $p,q$ and sets $n = pq$, then other parties would also have to know $p$ and $q$, because it is the only way to get the same $n$.

But you just left out a part of the public key, which is $g$. This results in a different question:
If you have a trusted party set up $n$ and assign different $g$ values to each party, would that work? No it would not, because in the decryption process you need to calculate $c^{\lambda}$. And knowing $\lambda$ would allow the factorization of $n$. So basically every party would be able to decrypt the messages to every party, as if they were just using one public key.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.