Let $c_1$ and $c_2$ two encryptions of $m_1$ and $m_2$ using the Paillier Cryptosystem.

$c_1= E(m_1,r_1) = g^{m_1} r_1^n \bmod n^2$ and $c_2= E(m_2,r_2) = g^{m_2} r_2^n \bmod n^2$

Paillier homomorphic encryption enables us to combine two messages such as

$D\left(E(m_1,r_1) \cdot E(m_2,r_2) \mod n^2\right) = m_1+m_2 \mod n$

Given two random numbers in $\mathbb{Z}_n^*$, namely, $k_1$and $k_2$, we compute $k_3$ such that : $k_1$ + $k_2$ + $k_3$ = 0 mod ${\lambda}$

If we encrypt $m_1$ and $m_2$ to $c_1^{'}$ and $c_2^{'}$ as follow:

$c_1^{'}= E(m_1,r_1) = g^{m_1} g^{k_1} r_1^n \bmod n^2$ and $c_2^{'}= E(m_2,r_2) = g^{m_2} g^{k_2} r_2^n \bmod n^2$

Can we retrieve $m_1+m_2$ from $D\left(c_1^{'} \cdot c_2^{'} \cdot g^{k_3} \mod n^2\right)$ ?

  • $\begingroup$ Of course, you can with $k_3 = k_1+k_2$ $\endgroup$ – kelalaka Jun 15 at 0:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.