# Paillier Decryption?

Let $$c_1$$ and $$c_2$$ two encryptions of $$m_1$$ and $$m_2$$ using the Paillier Cryptosystem.

$$c_1= E(m_1,r_1) = g^{m_1} r_1^n \bmod n^2$$ and $$c_2= E(m_2,r_2) = g^{m_2} r_2^n \bmod n^2$$

Paillier homomorphic encryption enables us to combine two messages such as

$$D\left(E(m_1,r_1) \cdot E(m_2,r_2) \mod n^2\right) = m_1+m_2 \mod n$$

Given two random numbers in $$\mathbb{Z}_n^*$$, namely, $$k_1$$and $$k_2$$, we compute $$k_3$$ such that : $$k_1$$ + $$k_2$$ + $$k_3$$ = 0 mod $${\lambda}$$

If we encrypt $$m_1$$ and $$m_2$$ to $$c_1^{'}$$ and $$c_2^{'}$$ as follow:

$$c_1^{'}= E(m_1,r_1) = g^{m_1} g^{k_1} r_1^n \bmod n^2$$ and $$c_2^{'}= E(m_2,r_2) = g^{m_2} g^{k_2} r_2^n \bmod n^2$$

Can we retrieve $$m_1+m_2$$ from $$D\left(c_1^{'} \cdot c_2^{'} \cdot g^{k_3} \mod n^2\right)$$ ?

• Of course, you can with $k_3 = k_1+k_2$ – kelalaka Jun 15 at 0:27