Questions tagged [paillier]

A public-key cryptosystem invented by Pascal Paillier in 1999.

Filter by
Sorted by
Tagged with
2
votes
2answers
1k views

Paillier VS RSA

I was wondering if there are major pros or cons of choosing the Paillier algorithm over RSA except for Pailliers being additively homomorphic and RSA multiplicative?
2
votes
1answer
43 views

How do I choose blind sizes?

I am currently developing a service that calculates statistics (currently only sum/average) on homomorphically encrypted user data, and then gives the results to a third party. Because encryption is ...
0
votes
1answer
53 views

How to apply two consecutive Paillier encryptions?

The plaintext space for Paillier encryption is $\mathbb{Z}_n$ and the ciphertext space is $\mathbb{Z}_{n^2}$. How can I apply two consecutive encryptions? I mean, if $c$ is the ciphertext of $m$, how ...
0
votes
1answer
305 views

Lagrange Gauss Reduction Algorithm

Sorry if my question is trivial. My question is related to a post "Paillier Homomorphic encryption to calculate the means" where a member suggests Lagrange Gauss Reduction Algorithm for reducing a ...
6
votes
1answer
312 views

Zero knowledge proof for Paillier addition under multiple keys

Suppose $m_0, m_1, m_2 \in \mathbb{N}$ such that $m_0 = m_1 + m_2$, $m_i > 0$ (none of them can be 0 or lower) Under a Paillier cryptosystem, set $e_0 = E(m_0, r_0)$ for a public key $(g_0, n_0)$ ...
6
votes
2answers
1k views

Paillier Homomorphic encryption to calculate the means

Paillier Homomorphic encryption supports addition and multiplication with plaintext value. Can I use these properties to calculate the means of cipher-text values? I try to use the following steps: ...
0
votes
1answer
139 views

In Paillier homomorphic encryption, do we need to take modulo after multiplication of 2 ciphertexts?

The multiplication of 2 ciphertexts generated using Paillier encryption will result in encryption of sum of corresponding plaintexts. I need to do a linear combination operation of N integers in ...
0
votes
1answer
97 views

Taking $p$ and $q$ to be the same value in paillier cryptosystem

I was implementing Paillier cryptosystem when I came across the fact that as soon as I take the primes $p$ = $q$, I start getting incorrect decryption results. As far as I can understand, when I take $...
1
vote
1answer
200 views

Can McEliece cryptosystem be used as an additively homomorphic encryption scheme?

Since McElice cryptosystem is linear, if matrix G is kept constant for different plaintexts, it can be used for linearly combining the corresponding ciphertexts. In that case, what are the advantages ...
3
votes
2answers
764 views

Does Paillier Homomorphic Encryption Work only with numbers?

Paillier homomorphic encryption enables us to combine two messages such as $D\left(E(m_1,r_1) \cdot E(m_2,r_2) \mod n^2\right) = m_1+m_2 \mod n$ My question is what are the specification of $m_1$ ...
4
votes
1answer
150 views

Paillier paper: Number Theoretic Lemma doesn't seem to work

I'm reading the original Paillier paper. I've reached Lemma 3: If the order of $g$ is a nonzero multiple of $n$, then $\varepsilon_g(x,y) = g^x y^n \mod n^2$ is a bijection, where $x \in \mathbb{Z}_n$...
3
votes
2answers
2k views

How to prove correct decryption in Paillier cryptosystem

Bob sends a ciphertext obtained by Paillier encryption to Alice. Alice has the private key. She decrypts the ciphertext and returns the plaintext to Bob. How can Alice convince Bob that the ...
0
votes
1answer
559 views

Zero-Knowledge proof with the paillier cryptosystem

For a paillier cryptosystem how can I perform a zero-knowledge proof? Given a set of values: 0001 0010 0100 1000 This would be for use in a voting system where we want to ensure we where given a ...
3
votes
1answer
713 views

Paillier's Cryptosystem - Secure Key Size

Given Paillier's Cryptosystem. What size in bits would be considered secure for now and the near future? I know it differs for every cryptosystem. For reference, the most important part of my ...
1
vote
1answer
190 views

PHE/FHE add and compare attack

I am aware of this attack that applies to PHE (partially homomorphic encryption) given the attacker has access to a trusted oracle that can Convert (i.e decrypt and ...
5
votes
2answers
437 views

SPDZ for the 2-party case

There exist protocols for 2-party computation e.g., GMW that use Boolean circuits. I could also use Paillier and arithmetic circuits for a 2 party computation. However after reading about SPDZ is my ...
5
votes
2answers
613 views

Showing the decrypted sum of encrypted values

Is there a system that would allow to encrypt values with one or more keys, sum the encrypted values, and reveal a key which could only decrypt the sum. Essentially would be able to show encrypted ...
4
votes
1answer
773 views

Paillier encryption: Many private keys for a public key

Assume $N$ is a public key for paillier encryption, generated by a third party. Question: Given $N$ can each client generate its own private key, such that its public key is $N$? So all parties ...
1
vote
1answer
224 views

Oblivious Polynomial Evaluation and Encoding Payload

I am trying to parse this paper. I think I do come to understand the general concepts go into this type of Private Set Intersection, based on Oblivious Polynomial Evaluation. I was able to produce a ...
3
votes
1answer
90 views

Homomorphic $\bmod p$ operation

Let $E(m)$ a be the encryption operation using Paillier encryption scheme. Let $N$ be the public key and $p$ be a large prime number, such that $p<N$. Question: Is there any protocol, that given $...
2
votes
1answer
331 views

a homomorphic operation on Paillier encryption

Assume $N=pq$, where $p$ and $q$ are two strong prime numbers. Also, assume we have finite field $\mathbb{F}_u$ where $u$ is a $112$ bit prime number. Let $r_i$ be a uniformly random element of $\...
-1
votes
1answer
925 views

Why does Paillier have poor performance?

Can anyone explain to me why Paillier crypto system does not provide good performance? I read here (pdf) that RSA and ElGamal provide better performance than Paillier algorithm.
3
votes
2answers
1k views

Are Paillier and El Gamal encryption schemes secure against quantum attacks?

I was wondering if there is a security difference between Lattice based homomorphic encryption schemes versus an partially homomorphic encryption scheme like Paillier, and El Gamal encryption schemes ...
1
vote
2answers
545 views

In Paillier homomorphism how do you substract?

I'm trying to learn homomorphism so the problem may also be in my code (which I will include). I want to compute $a - b$ where $a$ is bigger then $b$. In order to do this I tried to compute $\frac{a}...
0
votes
1answer
201 views

In Paillier homomorphism, how do you deal with bit length? [closed]

I'm trying to figure out homomorphic encryption and would like to multiply two paillier encrypted numbers. Like so: [a].[b]=[a+b] To try this I got this Paillier.java and tried the following: <...
3
votes
1answer
392 views

identifying presence of encryption of zero in additive homomorphic encryption

Lets say the server has corpus of ciphertext contains $enc(a),enc(b),enc(c), \dotsc enc(x)$. The encryption function is an additive homomorphic scheme (like Paillier). The server knows only the public ...
6
votes
1answer
463 views

Equality checking using additive homomorphic encryption

Given two ciphertexts $c_1 = enc(p_1)$ and $c_2= enc(p_2)$ using any additive homomorphic encryption scheme (or specifically Paillier). Can we find out whether the underlying plaintexts $p_1,p_2$ ...
5
votes
2answers
858 views

Zero-knowledge proof for the product of additive Paillier ciphers

Suppose that Alice received the cipher values: $E(x_1), E(x_2), ..., E(x_n)$ that are encrypted using Paillier cryptosystem by $n$ entities with Bob's public key. Alice computes $E(\sum x_i)$ from ...
5
votes
0answers
355 views

Additively homomorphic cryptosystem with non-interactive zero-knowledge proof of non-negativity

I need a cryptosystem that is additively homomorphic. Paillier preferably, but not neccessarily. Also, for every ciphertext the private key holder must be able to prove non-interactively that the ...
4
votes
2answers
2k views

Why is Paillier Cryptosystem called probabilistic?

The definition of Paillier Cryptosystem says that it is a probabilistic asymmetric key algorithm for public key cryptography. Can some body explain why it is called "probabilistic"?
4
votes
1answer
243 views

Why multiple homomorphic operations on a ciphertext leaks no information about the plaintext?

Scenario: Assume I encrypt message $m$ using Paillier encryption, so I would get $c=E(m)$. I give the identical $c$ to two different parties, parties $D$ and $E$. Party $D$ computes: $c_{D}= E(m)^{...
5
votes
1answer
311 views

Usefulness of Damgård–Jurik

I am trying to understand what are the benefits of using Damgård–Jurik over Paillier. I understand that expansion factor decreases as s increases. But isn't it the ...
4
votes
0answers
82 views

Are there any real-world E-voting systems in use with the Paillier cryptosystem?

There are a lot of theories of Paillier cryptosystem with references to e-voting. Are there any real-world E-voting systems in use with the Paillier cryptosystem?
5
votes
1answer
206 views

Making Pascal Paillier' output absolute

Can we make subtraction result of cipher texts encrypted by Pascal Paillier absolute. Just like we use method Math.abs() in Java ? For example, if we subtract 0 from 1: 1-0 = 1, it is positive but 0-1 ...
3
votes
1answer
145 views

How to calculate Enc(-m) from Enc(m) in Paillier cryptosystem?

The encryption in Paillier cryptosystem is like this according to Wikipedia: Let $m$ be a message to be encrypted where $m \in \mathbb{Z}_n$ Select random $r$ where $r \in \mathbb{Z}_n^*$ Compute ...
1
vote
2answers
348 views

Paillier cryptosystem, small integers and range of values

First, this a different take on my previous question: Pailler encryption of small integers to 32-bit integers I have to encode small integers (range 0-50) using the Paillier cryptosystem. Those ...
3
votes
1answer
628 views

Paillier Cryptosystem - Practical applications?

I wonder: are there any real-world practical applications using the Paillier cryptosystem , as introduced in [1], or some derivations of it? I'm aware of quite a few schemes proposed in literature ...
1
vote
1answer
2k views

ElGamal and Paillier key sizes for short messages

I am using ElGamal and Paillier schemes to encrypt a large number of short messages: typical 4-byte integers. I do this for the homomorphic properties of these schemes. However, the way the ...
6
votes
1answer
282 views

What if the p and q used in keys generation of Pailler cryptosystem are composite?

I've seen a few implementations of Paillier cryptosystem that uses probable primes to choose $p$ and $q$. Assuming that a keypair is generated with $p$ and $q$ that are coprime and that $pq$ is ...
2
votes
1answer
221 views

Weakening of Paillier cryptosystem due to ciphertext equivalence and order in CryptDB

The Paillier cryptosystem is probabilistic in nature and IND-CPA secure. By design given two ciphertexts one cannot distinguish whether decrypting those two ciphertexts will result in same or ...
0
votes
2answers
356 views

Pailler encryption of small integers to 32-bit integers

I want to encrypt very small integers in the range 0-44 using the Paillier cryptosystem. Is there a way to select p, ...
3
votes
2answers
351 views

Does the Paillier system remain secure if it is used to encrypt only binary values, i.e. {0, 1}?

Is there any security compromises if the Paillier system was used to encrypt only binary message in {0, 1}? i.e., plaintexts are either 0 or 1.
1
vote
1answer
313 views

Paillier Encryption: problems with double encryption

Given have two public keys $k1$ and $k2$, $E_{k1}(E_{k2}(m_1))$ and $m_2$. Is it possible to calculate $E_{k1}(E_{k2}(m_1 + m2))$? (or with multiplication instead of addition) At a first glance, I ...
3
votes
1answer
441 views

Paillier cryptosystem preserve ordering of sums for two integer sequences

According to Paillier cryptosystem the product of two ciphertexts will decrypt to the sum of their corresponding plaintexts. I have two separate integer sequences X and Y that have same number of ...
2
votes
0answers
148 views

Proving that a plaintext is the Paillier decryption of a certain ciphertext [duplicate]

Assume that Alice received 100 ciphertexts encrypted with additive homomorphic encryption, say Paillier, using the same public key that belongs to Bob. Alice added all of them, and wants to know the ...
2
votes
2answers
172 views

Formal security of recycled random blinding in a Paillier scheme

This question is a follow-up/variant on a previous question. Supposing that we are trying to generate a large number of (indistinguishable) ciphertexts of a given plaintext and want to avoid the ...
2
votes
1answer
176 views

How bad would it be to reuse the random blinding factor in a scheme like Paillier?

A secure and somewhat fast way to "re-encrypt" (refresh? anonymise?) a Paillier ciphertext, $c$, is to multiply it by an exponentiated random value: $c \gets c \cdot r^n \mod n^2$ (with $r \in \...
1
vote
1answer
895 views

Performance bottlenecks in Paillier encryption

I'm implementing Paillier encryption and I'd like some recommendations about improving its performance. Firstly, I have to note the following: I have already set g=1+n to get rid of one ...
-3
votes
1answer
824 views

can anyone give the java code to encrypt files using paillier [closed]

I want to implement encryption on personal files using paillier encryption. Is it possible to encrypt files using this encryption..
1
vote
0answers
580 views

RSA or Paillier is good? [closed]

I want to implement file storage in cloud using homomorphic encryption. I want to use paillier encryption. Can you suggest the drawback of RSA to store and retrieving the files. Then only i can use ...