Given the instance $(n, g, \lambda)$ of Paillier cryptosystem with $\text{ord}(g) = n \lambda$ (symbols have their usual meaning), and $c = g^{na}$, is it possible to distinguish (computationally) $c' = g^{nab}$ from a random element in $\mathbb{Z}_{n^2}^*$, where $b \in_{R} \mathbb{Z}_{n\lambda}$?
I believe that given $g^{na}$ and $g^{nab}$, it is hard to find $b$ because that would imply security considerations against the homomorphic multiplication property of the Paillier scheme. Does the above mentioned pseudorandomness property also hold?

Could this property depend on the kind of primes chosen in $n = p \cdot q$?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.