I want to compare additive secret share to Paillier encryption. However, I haven't found out how to set the parameters in such a way that the security level is consistent. Additive secret share (explained in SecureML) just like this: $a_1 = a - a_0 \mod 2^l$

  • $\begingroup$ Please check the edits made to the post. Please format the question to the best of your abilities and re-read before posting. $\endgroup$
    – Maarten Bodewes
    Jul 19, 2021 at 14:14

1 Answer 1


I haven't found out how to set the parameters in such a way that the security level is consistent.

The problem is that they can't be consistent; secret sharing will always score better on "cryptographical security" than Pallier, no matter what parameters you use.

With Pallier, if you have the ciphertext and the public key, one could recover the plaintext with enough computation. If you chose the parameters (e.g. size of the modulus) well, this amount of computation is far more than what any realistic attacker could hope to achieve, however it will still be possible.

With secret share (of which additive secret sharing is one example), this is not true; if you have $t-1$ shares (where $t$ is the "threshold, that is, the number of shares you need to recover the secret - in your example, you would have $t=2$), and nothing else, you cannot learn anything about the secret. This holds no matter how much computational resources you have - you literally don't have enough information. To compare to Paillier, this would be as if you were asked to decrypt a ciphertext, but you weren't given the ciphertext.

Now, as for advice as to address your comparison, I would suggest setting your Paillier parameters to be infeasible to break by current adversaries - this might have $n$ to be perhaps 2048 bits (so $n^2$ would be 4096 bits). While this won't be a true apples-to-apples comparison, it would be not unreasonable either in terms of practical security.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.