How to authenticate indivisual value after applying homomorphic encryption using Paillier homomorphic

Assuming I have three parties in a system: Alice, Bob, and a Server. Alice and Bob needs to aggregate some messages $m1$ for Alice, and $m2$ for Bob. And send the aggregate $m1+m2$ to the Server.

I used Paillier homomorphic encryption as follows: $D\left(E(m_1,r_1) \cdot E(m_2,r_2) \mod n^2\right) = m_1+m_2 \mod n$

Assuming that $m1,m2\in \mathbb{Z_{100,000}}$

This provides privacy in which the server cannot link any of the measurements to the server (assuming that aggregation is performed in a secure way without leaking any single encryption to the server)

My question is twofold:

1) What I am trying to achieve now is to authenticate the aggregate $m1+m2$ on the server side, in a way that Alice and Bob can prove they are the only parties that can generate this aggregate.

2) Alice and Bob are trusted by the server. Hence, I tried to use Pedersen commitment: in which Alice creates a commitment on her message using new random number $r_A$ to be $Commit_{Alice}(m1,r_A)$. And the commitment for Bob will be $Commit_{Bob}(m2,r_B)$. The aggregate of these commitments will get Commit_{Total}(m1+m2,r_A+r_B). The server will get the total commit. For the server to reveal/verify the commitment he needs (a) $m1+m2$: This is easily delivered using the homomorphic encryption above. and also needs, (b) $r_A+r_B$, the problem is how to deliver this, I though of the following ways:

2.1) Assuming that Alice will aggregate the commitments, when she receives $Commit_{Bob}(m2,r_B)$ from Bob, he will also send $r_B$. but the problem with this that Alice can simply crack it by trying different messages for $m2$. This is because $m1,m2 \in [1,100,000]$

2.2) Alice and Bob each indivisually sends $r_A$ and $r_B$ to the server in which it combines them to reveal the total commitment. This is not efficient because it will cause communication overhead.

Is there another secure way. We can assume that Alice and Bob each can communicate securely with the server. And each can share secure identifier (signature) with the server.

Thank you,

• Alice generated the Paillier keys, encrypted $m_1$, then Bob encrypted $m_2$ and sent this encryption to Alice, who finally added the two ciphertexts homomorphically? – Marcellus May 30 '17 at 19:20
• the server generate the homomorphic keys. And values are aggregated by Alice or Bob (assuming they are trusted for this operation). Thank you for your comment. – Sari May 30 '17 at 22:22