Questions tagged [paillier]

A public-key cryptosystem invented by Pascal Paillier in 1999.

Filter by
Sorted by
Tagged with
1
vote
1answer
32 views

How to prove correct decryption in Goldwasser-Micali cryptosystem

In How to prove correct decryption in Paillier cryptosystem, it was asked whether Alice (in sole possession of the secret key) can convince Bob that a given plaintext is the decryption of a ciphertext ...
3
votes
0answers
45 views

Optimisation of Pailler decryption

In this article applying Pailler encryption and decryption to image bitmaps, Table II is reported to give Execution Time (sec) of the Paillier encryption/decryption of image using different key sizes ...
0
votes
0answers
52 views

Paillier scheme : Encoding floats into integers impact on computations

In Privacy Preserving Processing Over Encrypted Images, I could understand that appropriate encoding of floats into integers (required in Paillier) only incur negligible error in computations. Any ...
1
vote
1answer
76 views

Is Paillier a stream or block encryption

Does Paillier follow a stream encryption or block encryption technique. If it’s a block encryption then what is the size of the block in bits or bytes.
1
vote
0answers
61 views

Efficiently prove the correctness of Paillier encryption in or “outside” a zk-SNARK

I'm working with a zk-SNARK library [1] that allows me to prove the correctness of arbitrary arithmetic circuits, and I now want to use these zk-SNARKs to prove that some Paillier [2] ciphertext $c$ ...
0
votes
1answer
56 views

Evaluate the time of Paillier decryption

If I have 4 kilobytes of Paillier encrypted data, how can I know the time needed to decrypt it?
1
vote
1answer
76 views

Security of Paillier against chosen ciphertext attack

Is there a proof by now that Paillier is secure against chosen-ciphertext attack? The original Paillier paper mentions that it is not.
1
vote
1answer
38 views

Prove the correctness of decryption process of Paillier cipher

The definition of Paillier cryptosystem is the same as the one on wikipedia. Now the random integer $g$ is chosen of the form $$g=(1+n)^{\alpha}\beta^{n}\bmod n$$, where $\alpha$ and $\beta$ are in $\...
1
vote
1answer
51 views

can we know the sign of a ciphertext (homomorphic)

Is it possible to know the sign (positive or negative) of an homomorphic ciphertext particularly under paillier scheme ?
2
votes
0answers
41 views

Possibility of computing a and b values from the ciphertext?

Using paillier encryption, $N$ is the product of two large prime numbers, $s$ is sampled randomly from $Z_{N^2}$ we get $ C \leftarrow g^ms^N \bmod N^2 $ where $g=1+N$, By multiplying the cipher $c$ ...
1
vote
0answers
68 views

Elliptic curve subgroup with $p$ elements in field of characteristic $p$

Are there any elliptic curves defined over a finite field $\mathrm{GF}(p^k)$ with a subgroup of order $p$ where the discrete log (and preferably DDH) problem is hard? Elliptic curve with prime ...
0
votes
0answers
23 views

Identify the value of the plaintext from a noised expression

Having the following instructions: Using Paillier encryption to encrypt $m$. So, we get $Enc(m)$ Multiply $Enc(m)$ and $A$ to Get $C$. So, $C = Enc(m).A $ Decrypt $C$ using Paillier Decryption ...
0
votes
0answers
35 views

Can a partially homomorphic encryption scheme be made CCA1 Secure? [duplicate]

Can a partially homomorphic encryption scheme be made CCA1 Secure? like paillier ? what is the highest security for any PHE?
1
vote
0answers
50 views

How to store the ciphertext generated by the paillier encryption in a pixel?

Goal: I want to implement a paillier algorithm to encrypt images and hide some data reversibly. This is the paper that proposed this algorithm: https://www.sciencedirect.com/science/article/abs/pii/...
0
votes
0answers
81 views

Paillier Decryption?

Let $c_1$ and $c_2$ two encryptions of $m_1$ and $m_2$ using the Paillier Cryptosystem. $c_1= E(m_1,r_1) = g^{m_1} r_1^n \bmod n^2$ and $c_2= E(m_2,r_2) = g^{m_2} r_2^n \bmod n^2$ Paillier ...
3
votes
1answer
131 views

Proof of lemma 1 Paillier encryption

In the original paper of Paillier, lemma 1 shows why $n$ must divide the order of $g$. What I don't understand in the proof of this lemma is why $g^{x_2-x_1}(y_2/y_1)^n$ implies $g^{\lambda(x_2-x_1)}$....
1
vote
1answer
56 views

Paillier scheme and noise growth

Does the problem of noise growth exist in the Paillier homomorphic scheme ?
4
votes
2answers
152 views

Do any probabilistic hashing algorithms have additive homomorphism?

What I am looking for is a function that meets the following criteria: For each possible input (assume integers from [0, 255]), there must be trillions of possible outputs so as to prevent preimage ...
1
vote
0answers
63 views

Homomorphic encrypted streams (Paillier)

Situation: Alice (violin) and Bob (drums) play music together and want to (real-time) stream the concert to Carol. In order for Carol to save bandwidth, the stream is sent through a server which ...
0
votes
1answer
100 views

random mask reversible after homomorphic encryption

I would like to know if this process is feasible under homomorphic encryption, ideally under paillier or any other additive scheme Apply a mask X to obfuscate a message A ie. Am = A (op) X where (op)...
0
votes
1answer
46 views

A modified question of Hazay & Lindell's Efficient Secure Two-Party protocols Book

Based on the question proposed on page 27, we propose a modified question as follows: Suppose the protocol is based on Paillier cryptosystem and $P_2$ has generated related public and private keys ($...
1
vote
1answer
95 views

Paillier's Cryptosystem - Homomorphism

I'm lacking quite some mathematical knowledge here, but could anyone please explain to me why the Paillier cryptosystem is still (additive/multiplicative) homomorphic despite introducing a random ...
2
votes
1answer
122 views

Paillier Private $\mu$ and $\lambda$

The Paillier CryptoSystem has a public key that $(g,n)$ and the private key which can be exclusive to $\lambda$, where the decryption scheme is: $m = L(c^\lambda \bmod n^2)/L(g^\lambda \bmod n^2) \...
1
vote
1answer
74 views

Paillier Complex Residuosity problem?

Paillier Cryptosystem depends on both the factorization where $n = p.q$ and the complex residuosity problem which is defined in the original paper as: The problem of deciding n-th residuosity, i.e. ...
1
vote
1answer
78 views

Is it possible to calculate the random factor $r$ from a encrypted message and the private key in a Paillier cryptosystem?

I have already done my research and found various sources that state that it is possible but there are also a lot of them that says it is not possible to recover $r$. This Q/A on this site for example ...
2
votes
0answers
68 views

Compute ln function of a Paillier encrypted value [closed]

If I have an encrypted value $Enc(x)$ with Paillier cryptosystem, is it feasible to compute an encryption form of $\ln(x)$ or its approximation using homomorphic properties? The input $x$ is always ...
-1
votes
1answer
50 views

Deterministic procedure for mapping an arbitrary value into a 𝑝,𝑞 pair for public key cryptography

I want public key cryptosystem to used for re-encryption as describe in Can Paillier ,RSA or any other schemes be used for universal re-encryption like elGamal? Now i have little solution for ...
2
votes
1answer
144 views

Can Paillier ,RSA or any other schemes be used for universal re-encryption like elGamal?

ElGamal, RSA, and Paillier cryptosystem have homomorphic property, and can be used fro re-encryption purposes. I want to use the encryption to re-encrypt ciphertext(as in proxy re-encryption but ...
0
votes
0answers
33 views

Can Paillier Encryption has independent decryption key?

As Pailliear cryptosystem secret key $\lambda$, depends on primes $p$ and $q$. As $\lambda = \operatorname{lcm}(p-1,q-1)$. I want decryption key to independent from $p$ and $q$. It can be possible ...
1
vote
1answer
152 views

How Paillier cryptosystem can be used practically to encrypt and decrypt big messages “m”?

I want to use the Paillier cryptosystem for encryption and decryption purposes in my research work. But i haven't found a way to encrypt big input messages; As i want to encrypt the message i,e m : <...
1
vote
1answer
71 views

Is there any relationship between Paillier Cryptosystem's random r and other factors

I want to try run an example of Paillier cryptosystem(Algorithm), So i just started with some basic examples, but cannot obtain correct result/decryption. I just change random factor ...
1
vote
1answer
858 views

Comparison of values in Paillier homomorphic encryption

For a project, I am using homomorphic encryption with the Paillier cryptosystem, and I have to compare two values... Can this be done using homomorphic encryption? And I know subtraction can be done ...
3
votes
1answer
2k views

In which public key encryption algorithms are the private and public key not reversible?

The RSA public key encryption system has the characteristic that the public key and the private key can be reversed. That is, information encrypted with the public key can be decrypted with the ...
0
votes
1answer
122 views

Homomorphic/Paillier crypto system for use case?: overflow for multiple counter exponent possible? Different cipher factor needed all the time?

Recently I read about homomorphic cryptosystem. They might solve a problem. To do this there need to be some modifications from standard version. Using Paillier here but a solution for other also ...
4
votes
1answer
184 views

Zero-knowledge proof for Paillier parameters

For RSA one can give a non-interactive zero-knowledge proof that RSA with parameters $(e,N)$ form a permutation and a proof of knowledge of the associated RSA secret key. For example, such a proof can ...
3
votes
1answer
123 views

Order of g in Paillier Scheme

I'm trying to understand the Paillier Scheme but there's something I can't understand in the keyGen algorithm: Ensure $n$ divides the order of $g$ by checking the existence of the following ...
0
votes
0answers
145 views

homomorphic division with scaling/Paillier

Let's say that I have to use fractions instead of integers and I am using Paillier cryptosystem. So, I use scaling to obtain integers. Assume that I have a secure division protocol. What happens if ...
1
vote
0answers
40 views

Pseudorandomness based on homomorphic multiplication property of Paillier cryptosystem

Given the instance $(n, g, \lambda)$ of Paillier cryptosystem with $\text{ord}(g) = n \lambda$ (symbols have their usual meaning), and $c = g^{na}$, is it possible to distinguish (computationally) $c' ...
2
votes
1answer
329 views

How to calculate random factor in Paillier cryptosystem?

I am currently learning paillier cryptosystem,and have two questions about random r.I use the characteristics of homomorphic addition to obtain the product of two ciphertexts C and the corresponding ...
3
votes
2answers
211 views

Homomorphic properties of Paillier

I'm curious about the homomorphic properties of Paillier. So, basically if I have $\textsf{Dec}(\textsf{sk}, \textsf{Enc}(\textsf{pk}, \alpha) \cdot \textsf{Enc}(\textsf{pk}, \alpha^{-1}))$, I will ...
4
votes
1answer
111 views

Prove that some Cyphertext C encrypts some plaintext D

I have a Paillier Cyphertext C and a counterparty that controls the keypair that was used to encrypt the data D to arrive at C. How can they prove to me that the Cyphertext C is actually the ...
4
votes
1answer
196 views

Can the CRT speed-up Paillier decryption by more than a factor of two?

In the Pailler cryptosystem, decryption goes $m\gets\displaystyle\left\lfloor\frac {\left(c^\lambda\bmod n^2\right)-1}n\right\rfloor\mu\bmod n$ with $\mu<n$ being a part of the private key just ...
1
vote
0answers
73 views

Combining share decryption on Paillier threshold scheme

I am trying to implement the Paillier threshold scheme described by Fouque, et al, but I am having an issue when combining share decryptions. The scheme calculates the plaintext $M$ with the formula: ...
2
votes
1answer
262 views

Applying Chinese RemainderTheorem and Paillier Homomorphic encryption

I'm trying to optimize the decryption process for Paillier Homomorphic Encryption (PHE) using the Chinese Remainder Theorem (CRT). However, I want to check if there's a different way of applying CRT ...
3
votes
1answer
248 views

Paillier encryption problem when q or p divides r

I am having a problem with Paillier encryption as described on Wikipedia. It says to pick $0 < r < n$, where $n=pq$ for large, equally sized primes $p$ and $q$. However, I've been testing ...
2
votes
2answers
108 views

Bijective encryption function in Paillier cryptoststem

In Paillier cryptoststem many ciphertexts can correspond to the same plaintext. How can I modify the scheme so to make the correspondence between ciphertexts and plaintexts a one to one correspondece? ...
1
vote
1answer
198 views

In a specific Paillier implementation, why is r prime?

I have a question about an implementation of the Paillier cryptosystem. In the description of Paillier above, encryption of a plaintext message $m$ on $\mathbb {Z}_{n^{2}}$, $0\leq m<n$, proceeds ...
1
vote
1answer
372 views

Paillier: guessing the message when knowing the cipher and the random number

I cannot get my head around this. In Paillier, the ciphertext is calculated using $c = g^m.r^n\ mod\ n^2$ where $(n,g)$ forms the public key and $r$ is a random number $0<r<n$. Assuming an ...
1
vote
1answer
161 views

Paillier addition with plain text

$A$ sends $B$ the encryption $E_{pkA}(m)$. $B$ computes $R=xE_{pkA}(m) + y$ and sends $R$ back to $A$, but tells him nothing about the parameters $x$ and $y$. $A$ performs $D_{pkA}(R)$ and recovers ...
1
vote
1answer
106 views

Verification in Threshold RSA or Threshold Paillier

In the key generation of the threshold version of RSA or the threshold version of the Paillier cryptosystem (e.g. "Shoup - 2000 - Practical threshold signatures" or "Fouque et al. - 2000 - Sharing ...