# BGN encryption scheme with unbounded message space

In Evaluating 2-DNF Formulas on Ciphertexts stated that

decryption in this system takes polynomial time in the size of the message space T. Therefore, the system as described above can only be used to encrypt short messages

Is there any other extension with the same properties of (any number of addition and one multiplication operation on the ciphertext) but also allows bigger message space?

In my search, I encounter only in Converting Pairing-Based Cryptosystems from Composite-Order Groups to Prime-Order Groups, but it does not solve that limitation.

• What is  here? It says actually, when the message space come bigger, the decryption time become much longer. – kelalaka Feb 21 '19 at 20:45
• I edited and added  – user1387682 Feb 21 '19 at 23:03
• Is there a specific need for 2-DNF? – kelalaka Feb 21 '19 at 23:09
• Yes, but I need to extract only whether the result of the 2-DNF is equal to 0 or anything else. (Thus, I multiply it with random r in my scheme to obfuscate the exact value and hence need a bigger message space). – user1387682 Feb 21 '19 at 23:18
• 2-DNF is already semantically secure therefore to see it is 0 you need to decrypt. isn't FHE is better for you where you can compare? Note: there is no unbounded message space. – kelalaka Feb 21 '19 at 23:32

EDIT: reading the comments on your question, it seems you want to leak only whether the output is zero or not, by masking with a large random $$r$$ multiplicatively. But the standard BGN cryptosystem already allows that: the parties can always decrypt $$g_t^{\mathsf{DFN(x)}}$$ with BGN ($$g_t$$ is a generator of the target group), only the discrete logarithm at the end requires the message space to be small. However, seeing $$g_t^{r\cdot\mathsf{DFN(x)}}$$ for a large random $$r$$ already allows to see efficiently whether $$\mathsf{DFN(x)} = 0$$ or not: if it is equal to zero, then $$g_t^{r\cdot\mathsf{DFN(x)}} = 1$$; otherwise, $$g_t^{r\cdot\mathsf{DFN(x)}}$$ is just a random group element since $$r$$ is random.