# Questions tagged [paillier]

A public-key cryptosystem invented by Pascal Paillier in 1999.

144 questions
Filter by
Sorted by
Tagged with
47 views

### Why is asked that gcd(pq,(p-1)(q-1))=1 in the Paillier encryption scheme?

I don't see this property $\gcd(p\,q,(p-1)(q-1))=1$ used in the scheme. And in Paillier's original paper, I don't find this requirement. Is it required just for the difficulty of factoring $n$? Or is ...
33 views

### Searching in Paillier Cryptosystem

I have implemented Paillier Cryptosystem. Lets say, I have an encrypted array E(x) = [2,4,5,10,0,20] and I want to find that if 0 exist in that array. Due to the limitations of Paillier cryptosystem I ...
32 views

### Short randomness in ElGamal and Paillier

In the Paillier cryptosystem the encryption of $m \in \mathbb{Z}_N$ with randomness $r \in \mathbb{Z}_n^*$ is $c = g^m r^n \bmod{n^2}$. My question is, what if short (E.g. 512bits) $r$ is used? ...
30 views

### Generation of the order $\lambda$ (which is lcm((p-1),(q-1))) element g in modified paillier, why $-a^{2n}$?

As the question states, in variants of paillier cryptosystem, such as CS01 and DT-PKC, when they want an element $g$ of order $\lambda$, they choose a random number $a$ from group $Z^*_{n^2}$ and ...
78 views

### Do we need to consider overflow in paillier encryption?

Homomorphic multiplication of plaintexts in Paillier cryptosystem can be constructed as follow: Dsk(E(x1)^x2 mod N^2) = x1x2 mod N. So after the decryption, we get the result of multiplication x1x2. ...
97 views

### $n=pq$ and $n=p^2q$. How to take the value of two $n$ is the same in security

For example, Paillier's RSA modulus is $n=pq$, but OU's RSA modulus is $p^2q$. I think when two $n$ are the same, the security of the two cryptographic schemes must be different. So for example, if I ...
167 views

### How to calculate the n in n-bit security of a crypto algorithm?

I think I'm likely missing the term because searching for this is coming up with not so precise results. I'm looking to calculate the n-bit security of say Paillier vs ElGamal vs EC ElGamal, when I ...
52 views

### Paillier versus Lifted ElGamal for homomorphic addition for e-voting

I'm looking to create an anonymous e-Voting system which will assign a certain number of bits to each candidate during a vote, e.g. 010000 for Alice, 000100 for Bob, and 000001 for Charlie. It works ...
47 views

### Encrypting full word using Paillier Scheme

I am using Paillier scheme to encrypt a message however, I have divided the words into alphabets and then convert each alphabet to ASCII code encrypting the final result. It works fine, but I want to ...
32 views

### How to know the exact result in Paillier chiper-costant multiplication

The encryption function $E_{k^+}: Z_n \rightarrow Z_{n^2}$. The decryption function $D_{k^-}: Z_{n^2} \rightarrow Z_n$. $m_1 = 42, k = 15, n=77$. After encryption, exponentiation and decryption, I get:...
62 views

### What is the difference between Paillier additive homomorphic property and addition of two paillier ciphers

Paillier has additive homomorphic property that states: if two ciphers c1 and c2, are multiplied, and the result is decrypted, it is equal to addition of the two plaintexts. D(c1*c2)= m1+m2 ...
49 views

### How to prove correct decryption in Goldwasser-Micali cryptosystem

In How to prove correct decryption in Paillier cryptosystem, it was asked whether Alice (in sole possession of the secret key) can convince Bob that a given plaintext is the decryption of a ciphertext ...
57 views

### Optimisation of Pailler decryption

In this article applying Pailler encryption and decryption to image bitmaps, Table II is reported to give Execution Time (sec) of the Paillier encryption/decryption of image using different key sizes ...
67 views

### Paillier scheme : Encoding floats into integers impact on computations

In Privacy Preserving Processing Over Encrypted Images, I could understand that appropriate encoding of floats into integers (required in Paillier) only incur negligible error in computations. Any ...
86 views

### Is Paillier a stream or block encryption

Does Paillier follow a stream encryption or block encryption technique. If it’s a block encryption then what is the size of the block in bits or bytes.
94 views

### Efficiently prove the correctness of Paillier encryption in or "outside" a zk-SNARK

I'm working with a zk-SNARK library  that allows me to prove the correctness of arbitrary arithmetic circuits, and I now want to use these zk-SNARKs to prove that some Paillier  ciphertext $c$ ...
64 views

### Evaluate the time of Paillier decryption

If I have 4 kilobytes of Paillier encrypted data, how can I know the time needed to decrypt it?
117 views

### Security of Paillier against chosen ciphertext attack

Is there a proof by now that Paillier is secure against chosen-ciphertext attack? The original Paillier paper mentions that it is not.
70 views

110 views

### Paillier's Cryptosystem - Homomorphism

I'm lacking quite some mathematical knowledge here, but could anyone please explain to me why the Paillier cryptosystem is still (additive/multiplicative) homomorphic despite introducing a random ...
132 views

The Paillier CryptoSystem has a public key that $(g,n)$ and the private key which can be exclusive to $\lambda$, where the decryption scheme is: $m = L(c^\lambda \bmod n^2)/L(g^\lambda \bmod n^2) \... 1answer 85 views ### Paillier Complex Residuosity problem? Paillier Cryptosystem depends on both the factorization where$n = p.q$and the complex residuosity problem which is defined in the original paper as: The problem of deciding n-th residuosity, i.e. ... 1answer 86 views ### Is it possible to calculate the random factor$r$from a encrypted message and the private key in a Paillier cryptosystem? I have already done my research and found various sources that state that it is possible but there are also a lot of them that says it is not possible to recover$r$. This Q/A on this site for example ... 0answers 75 views ### Compute ln function of a Paillier encrypted value [closed] If I have an encrypted value$Enc(x)$with Paillier cryptosystem, is it feasible to compute an encryption form of$\ln(x)$or its approximation using homomorphic properties? The input$x$is always ... 1answer 52 views ### Deterministic procedure for mapping an arbitrary value into a 𝑝,𝑞 pair for public key cryptography I want public key cryptosystem to used for re-encryption as describe in Can Paillier ,RSA or any other schemes be used for universal re-encryption like elGamal? Now i have little solution for ... 1answer 182 views ### Can Paillier ,RSA or any other schemes be used for universal re-encryption like elGamal? ElGamal, RSA, and Paillier cryptosystem have homomorphic property, and can be used fro re-encryption purposes. I want to use the encryption to re-encrypt ciphertext(as in proxy re-encryption but ... 0answers 34 views ### Can Paillier Encryption has independent decryption key? As Pailliear cryptosystem secret key$\lambda$, depends on primes$p$and$q$. As$\lambda = \operatorname{lcm}(p-1,q-1)$. I want decryption key to independent from$p$and$q$. It can be possible ... 1answer 189 views ### How Paillier cryptosystem can be used practically to encrypt and decrypt big messages "m"? I want to use the Paillier cryptosystem for encryption and decryption purposes in my research work. But i haven't found a way to encrypt big input messages; As i want to encrypt the message i,e m : <... 1answer 78 views ### Is there any relationship between Paillier Cryptosystem's random r and other factors I want to try run an example of Paillier cryptosystem(Algorithm), So i just started with some basic examples, but cannot obtain correct result/decryption. I just change random factor ... 1answer 1k views ### Comparison of values in Paillier homomorphic encryption For a project, I am using homomorphic encryption with the Paillier cryptosystem, and I have to compare two values... Can this be done using homomorphic encryption? And I know subtraction can be done ... 1answer 2k views ### In which public key encryption algorithms are the private and public key not reversible? The RSA public key encryption system has the characteristic that the public key and the private key can be reversed. That is, information encrypted with the public key can be decrypted with the ... 1answer 148 views ### Homomorphic/Paillier crypto system for use case?: overflow for multiple counter exponent possible? Different cipher factor needed all the time? Recently I read about homomorphic cryptosystem. They might solve a problem. To do this there need to be some modifications from standard version. Using Paillier here but a solution for other also ... 1answer 213 views ### Zero-knowledge proof for Paillier parameters For RSA one can give a non-interactive zero-knowledge proof that RSA with parameters$(e,N)$form a permutation and a proof of knowledge of the associated RSA secret key. For example, such a proof can ... 1answer 139 views ### Order of g in Paillier Scheme I'm trying to understand the Paillier Scheme but there's something I can't understand in the keyGen algorithm: Ensure$n$divides the order of$g$by checking the existence of the following ... 0answers 165 views ### homomorphic division with scaling/Paillier Let's say that I have to use fractions instead of integers and I am using Paillier cryptosystem. So, I use scaling to obtain integers. Assume that I have a secure division protocol. What happens if ... 0answers 41 views ### Pseudorandomness based on homomorphic multiplication property of Paillier cryptosystem Given the instance$(n, g, \lambda)$of Paillier cryptosystem with$\text{ord}(g) = n \lambda$(symbols have their usual meaning), and$c = g^{na}$, is it possible to distinguish (computationally)$c' ...
I'm curious about the homomorphic properties of Paillier. So, basically if I have $\textsf{Dec}(\textsf{sk}, \textsf{Enc}(\textsf{pk}, \alpha) \cdot \textsf{Enc}(\textsf{pk}, \alpha^{-1}))$, I will ...