Questions tagged [paillier]
A public-key cryptosystem invented by Pascal Paillier in 1999.
113
questions
1
vote
1answer
78 views
Paillier Private $\mu$ and $\lambda$
The Paillier CryptoSystem has a public key that $(g,n)$ and the private key which can be exclusive to $\lambda$, where the decryption scheme is:
$m = L(c^\lambda \ mod \ n^2)/L(g^\lambda \ mod \ n^2)\...
1
vote
1answer
38 views
Paillier Complex Residuosity problem?
Paillier Cryptosystem depends on both the factorization where $n = p.q$ and the complex residuosity problem which is defined in the original paper as:
The problem of deciding n-th residuosity, i.e. ...
0
votes
0answers
44 views
Why is the Paillier cryptosystem not considered fully homomorphic encryption? [duplicate]
Paillier is an additive homomorphic encryption system that can achieve the encrypted version of its sums.
However, we can calculate the encrypted version of their multiplications by raising an ...
0
votes
1answer
36 views
Is it possible to calculate the random factor r from a encrypted message and the private key in a paillier cryptosystem?
I have already done my research and found various sources that state that it is possible but there are also a lot of them that says it is not possible to recover $r$, this for example even states the ...
2
votes
0answers
46 views
Compute ln function of a Paillier encrypted value [closed]
If I have an encrypted value $Enc(x)$ with Paillier cryptosystem, is it feasible to compute an encryption form of $\ln(x)$ or its approximation using homomorphic properties? The input $x$ is always ...
-2
votes
1answer
27 views
Deterministic procedure for mapping an arbitrary value into a 𝑝,𝑞 pair for pubic key cryptography
I want public key cryptosystem to used for re-encryption as describe in Can Paillier ,RSA or any other schemes be used for universal re-encryption like elGamal?
Now i have little solution for ...
2
votes
1answer
49 views
Can Paillier ,RSA or any other schemes be used for universal re-encryption like elGamal?
ElGamal, RSA, and Paillier cryptosystem have homomorphic property, and can be used fro re-encryption purposes. I want to use the encryption to re-encrypt ciphertext(as in proxy re-encryption but ...
0
votes
0answers
25 views
Can Paillier Encryption has independent decryption key?
As Pailliear cryptosystem secret key $\lambda$, depends on primes $p$ and $q$. As $\lambda = \operatorname{lcm}(p-1,q-1)$.
I want decryption key to independent from $p$ and $q$.
It can be possible ...
1
vote
1answer
46 views
How Paillier cryptosystem can be used practically to encrypt and decrypt big messages “m”?
I want to use the Paillier cryptosystem for encryption and decryption purposes in my research work. But i haven't found a way to encrypt big input messages;
As i want to encrypt the message i,e m :
<...
1
vote
1answer
60 views
Is there any relationship between Paillier Cryptosystem's random r and other factors
I want to try run an example of Paillier cryptosystem(Algorithm), So i just started with some basic examples, but cannot obtain correct result/decryption.
I just change random factor ...
1
vote
1answer
48 views
Comparison of values in Paillier homomorphic encryption
For a project, I am using homomorphic encryption with the Paillier cryptosystem, and I have to compare two values...
Can this be done using homomorphic encryption?
And I know subtraction can be done ...
3
votes
1answer
1k views
In which public key encryption algorithms are the private and public key not reversible?
The RSA public key encryption system has the characteristic that the public key and the private key can be reversed. That is, information encrypted with the public key can be decrypted with the ...
0
votes
1answer
80 views
Homomorphic/Paillier crypto system for use case?: overflow for multiple counter exponent possible? Different cipher factor needed all the time?
Recently I read about homomorphic cryptosystem. They might solve a problem. To do this there need to be some modifications from standard version.
Using Paillier here but a solution for other also ...
3
votes
1answer
101 views
Zero-knowledge proof for Paillier parameters
For RSA one can give a non-interactive zero-knowledge proof that RSA with parameters $(e,N)$ form a permutation and a proof of knowledge of the associated RSA secret key. For example, such a proof can ...
2
votes
1answer
83 views
Order of g in Paillier Scheme
I'm trying to understand the Paillier Scheme but there's something I can't understand in the keyGen algorithm:
Ensure $n$ divides the order of $g$ by checking the existence of the following ...
0
votes
0answers
82 views
homomorphic division with scaling/Paillier
Let's say that I have to use fractions instead of integers and I am using Paillier cryptosystem. So, I use scaling to obtain integers. Assume that I have a secure division protocol. What happens if ...
1
vote
0answers
35 views
Pseudorandomness based on homomorphic multiplication property of Paillier cryptosystem
Given the instance $(n, g, \lambda)$ of Paillier cryptosystem with $\text{ord}(g) = n \lambda$ (symbols have their usual meaning), and $c = g^{na}$, is it possible to distinguish (computationally) $c' ...
2
votes
1answer
155 views
How to calculate random factor in Paillier cryptosystem?
I am currently learning paillier cryptosystem,and have two questions about random r.I use the characteristics of homomorphic addition to obtain the product of two ciphertexts C and the corresponding ...
2
votes
2answers
123 views
Homomorphic properties of Paillier
I'm curious about the homomorphic properties of Paillier. So, basically if I have $\textsf{Dec}(\textsf{sk}, \textsf{Enc}(\textsf{pk}, \alpha) \cdot \textsf{Enc}(\textsf{pk}, \alpha^{-1}))$, I will ...
4
votes
1answer
103 views
Prove that some Cyphertext C encrypts some plaintext D
I have a Paillier Cyphertext C and a counterparty that controls the keypair that was used to encrypt the data D to arrive at C.
How can they prove to me that the Cyphertext C is actually the ...
4
votes
1answer
116 views
Can the CRT speed-up Paillier decryption by more than a factor of two?
In the Pailler cryptosystem, decryption goes $m\gets\displaystyle\left\lfloor\frac {\left(c^\lambda\bmod n^2\right)-1}n\right\rfloor\mu\bmod n$ with $\mu<n$ being a part of the private key just ...
1
vote
0answers
55 views
Combining share decryption on Paillier threshold scheme
I am trying to implement the Paillier threshold scheme described by Fouque, et al, but I am having an issue when combining share decryptions.
The scheme calculates the plaintext $M$ with the formula:
...
2
votes
1answer
165 views
Applying Chinese RemainderTheorem and Paillier Homomorphic encryption
I'm trying to optimize the decryption process for Paillier Homomorphic Encryption (PHE) using the Chinese Remainder Theorem (CRT). However, I want to check if there's a different way of applying CRT ...
2
votes
1answer
112 views
Paillier encryption problem when q or p divides r
I am having a problem with Paillier encryption as described on Wikipedia. It says to pick $0 < r < n$, where $n=pq$ for large, equally sized primes $p$ and $q$. However, I've been testing ...
2
votes
2answers
81 views
Bijective encryption function in Paillier cryptoststem
In Paillier cryptoststem many ciphertexts can correspond to the same plaintext. How can I modify the scheme so to make the correspondence between ciphertexts and plaintexts a one to one correspondece? ...
1
vote
1answer
103 views
In a specific Paillier implementation, why is r prime?
I have a question about an implementation of the Paillier cryptosystem.
In the description of Paillier above, encryption of a plaintext message $m$ on $\mathbb {Z}_{n^{2}}$, $0\leq m<n$, proceeds ...
1
vote
1answer
362 views
Paillier: guessing the message when knowing the cipher and the random number
I cannot get my head around this.
In Paillier, the ciphertext is calculated using
$c = g^m.r^n\ mod\ n^2$
where $(n,g)$ forms the public key and $r$ is a random number $0<r<n$.
Assuming an ...
1
vote
1answer
92 views
Paillier addition with plain text
$A$ sends $B$ the encryption $E_{pkA}(m)$.
$B$ computes $R=xE_{pkA}(m) + y$ and sends $R$ back to $A$, but tells him nothing about the parameters $x$ and $y$.
$A$ performs $D_{pkA}(R)$ and recovers ...
1
vote
1answer
71 views
Verification in Threshold RSA or Threshold Paillier
In the key generation of the threshold version of RSA or the threshold version of the Paillier cryptosystem (e.g. "Shoup - 2000 - Practical threshold signatures" or "Fouque et al. - 2000 - Sharing ...
-1
votes
1answer
77 views
The way to calculate $r$ from $c=r^t\mod{n}$ where $(c,t,n)$ is known
I want to know if there is a easy way to calculate $r$ from $c=r^t\mod{n}$ where $(c,t,n)$ is known and $t=pq$ is an RSA?
If $n=t^2$, is it more easier?
2
votes
1answer
126 views
Question about Damgård–Jurik crypto system
I am reading the paper about Damgård–Jurik cryptosystem.
In the proof, I found this equation
$c^d = (g^mr^{n^s})^d = (\boxed{(1+n)^{j m}x^m}r^{n^s})^d = \boxed{(1+n)^{j md\pmod{n^s}}}(\boxed{...
2
votes
0answers
140 views
Is there any way to prove two numbers that are equal after Paillier encryptions?
I have two numbers $x_1$ and $x_2$, and there are two Paillier homomorphic encryption (public, private) key pairs $(p_1,r_1)$ and $(p_2, r_2)$. I only know $p_1, r_1$ and $p_2$. Suppose $C_1=E_{p_1}(...
0
votes
1answer
51 views
Is it possible to manage an encrypted dataset for face recognition?
Im in my final year of PhD in computer vision and my supervisor has given me a task that I am not very familiar with. So I am teaching myself homomorphic encryption everyday. This question is mostly ...
0
votes
1answer
228 views
Calculating distance between two vectors using Paillier homomorphic encryption [closed]
I am basically trying to perform euclidean distance calculation in the encrypted domain (Paillier encryption). Using the homomorphic properties of Paillier, the squared euclidean distance formula can ...
1
vote
1answer
109 views
Paillier's scheme generalisation
Paillier's scheme assume has message and ciphertext space equal to $\mathbb{Z}_N$ with $N=pq$, that is $N$ is the product of two different primes.
Is there a way to generalise this for $N$ that is ...
3
votes
1answer
164 views
How to compute Lambda in a Threshold Paillier scheme
I am evaluating a threshold Paillier scheme as described in the paper:
Ivan Damgard, Mads Jurik, Jesper Buus Nielsen, "A Generalization of Paillier’s Public-Key System with Applications to Electronic ...
1
vote
1answer
116 views
Paillier subtraction for negative result
I am trying to figure out subtraction on Paillier.
From what I read so far, given $m_1$ smaller than $m_2$ ($m_1<m_2$)
I can compute $E(m_2-m_1)$ as $E(m_2)\cdot E(m_1)^{-1}$ where $E(m_1)^{-1}$ ...
2
votes
1answer
106 views
Is Paillier secure from known plaintext attack for single character message?
Assuming I have three messages m1,m2,m3 where m1=m2=m3=1 and I compute c1,c2 and c3.
Does that mean that c1=c2=c3 in cipher-text from ?
If not, how many times can I encrypt a message m=1 and still ...
0
votes
1answer
169 views
Paillier Homomoprhic addition overflows after a certain value
I'm new to encryption and am trying to implement Paillier encryption from the wikipedia page here: https://en.wikipedia.org/wiki/Paillier_cryptosystem
I managed to implement the encryption and am ...
2
votes
1answer
85 views
I'm getting a non-integer (float) private key in Paillier encryption
I'm trying to implement the Paillier cryptosystem in Matlab using the key generation guidance available here: https://en.wikipedia.org/wiki/Paillier_cryptosystem#Key_generation, but the problem is ...
1
vote
0answers
118 views
Is it possible to re-cipher with Paillier?
I know that with ElGamal we can re-cipher and get a second ciphertext equal to the first.
Is it possible with Paillier too?
When saying "re-cipher", I mean "A sends me a message, that is encrypted ...
0
votes
1answer
106 views
algorithmic scheme to compare these two number encrypted using paillier cryptosystem
I have been going through https://eprint.iacr.org/2006/287.pdf (Conjunctive, Subset, and Range Queries on Encrypted Data by Dan boneh)
I am trying to implement the paillier system to create a secure ...
1
vote
2answers
930 views
Paillier VS RSA
I was wondering if there are major pros or cons of choosing the Paillier algorithm over RSA except for Pailliers being additively homomorphic and RSA multiplicative?
2
votes
1answer
40 views
How do I choose blind sizes?
I am currently developing a service that calculates statistics (currently only sum/average) on homomorphically encrypted user data, and then gives the results to a third party. Because encryption is ...
0
votes
1answer
46 views
How to apply two consecutive Paillier encryptions?
The plaintext space for Paillier encryption is $\mathbb{Z}_n$ and the ciphertext space is $\mathbb{Z}_{n^2}$. How can I apply two consecutive encryptions?
I mean, if $c$ is the ciphertext of $m$, how ...
0
votes
1answer
205 views
Lagrange Gauss Reduction Algorithm
Sorry if my question is trivial. My question is related to a post "Paillier Homomorphic encryption to calculate the means" where a member suggests Lagrange Gauss Reduction Algorithm for reducing a ...
4
votes
1answer
241 views
Zero knowledge proof for Paillier addition under multiple keys
Suppose $m_0, m_1, m_2 \in \mathbb{N}$ such that $m_0 = m_1 + m_2$, $m_i > 0$ (none of them can be 0 or lower)
Under a Paillier cryptosystem, set
$e_0 = E(m_0, r_0)$ for a public key $(g_0, n_0)$
...
6
votes
2answers
897 views
Paillier Homomorphic encryption to calculate the means
Paillier Homomorphic encryption supports addition and multiplication with plaintext value.
Can I use these properties to calculate the means of cipher-text values? I try to use the following steps:
...
0
votes
1answer
114 views
In Paillier homomorphic encryption, do we need to take modulo after multiplication of 2 ciphertexts?
The multiplication of 2 ciphertexts generated using Paillier encryption will result in encryption of sum of corresponding plaintexts. I need to do a linear combination operation of N integers in ...
0
votes
1answer
80 views
Taking $p$ and $q$ to be the same value in paillier cryptosystem
I was implementing Paillier cryptosystem when I came across the fact that as soon as I take the primes $p$ = $q$, I start getting incorrect decryption results.
As far as I can understand, when I take $...
