For a paillier cryptosystem how can I perform a zero-knowledge proof?

Given a set of values:

  • 0001
  • 0010
  • 0100
  • 1000

This would be for use in a voting system where we want to ensure we where given a value from the set of acceptable ballots without knowing which if the values where selected.

I have found some information suggesting it is possible but I can't find a succinct set of steps or explanation for how this could be accomplished.

  • 1
    $\begingroup$ The keywords you should use in your research are "proof of set membership" and "range proof", but I am not sure if you can find a construction for Paillier - if you choose the cryptosystem first, you are bound to what is possible there - you can't just add some random property. $\endgroup$
    – tylo
    Commented Apr 18, 2017 at 14:00

1 Answer 1


Found an implementation here: https://paillier.daylightingsociety.org/Paillier_Zero_Knowledge_Proof.pdf

  • $\begingroup$ Link only answers are highly discouraged here, so -1. I suggest you edit to answer your question. Then we can upvote. $\endgroup$
    – mikeazo
    Commented May 9, 2017 at 13:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.