# Paillier encryption: Many private keys for a public key

Assume $N$ is a public key for paillier encryption, generated by a third party.

Question: Given $N$ can each client generate its own private key, such that its public key is $N$? So all parties separately generate their private key, but their public key is the same.

• This might not directly answer your question (tylo did that already), but if you haven't yet done so, I suggest you to take a look on Distributed Key Generation protocols. I think you might be interested, for instance, on how to generate a public key such that no single party holds the whole private key. – Sergio A. Figueroa Sep 9 '16 at 12:03

If one party chooses primes $p,q$ and sets $n = pq$, then other parties would also have to know $p$ and $q$, because it is the only way to get the same $n$.
But you just left out a part of the public key, which is $g$. This results in a different question:
If you have a trusted party set up $n$ and assign different $g$ values to each party, would that work? No it would not, because in the decryption process you need to calculate $c^{\lambda}$. And knowing $\lambda$ would allow the factorization of $n$. So basically every party would be able to decrypt the messages to every party, as if they were just using one public key.