Search Results

If $n$ is prime, then it is easy; we have $$r = c^{t^{-1} \bmod n-1} \bmod n$$ If $n$ is a composite of known factorization, then it is still easy; one approach would be to have: $$r = c^{t^{-1} \b …

Is it yet proofed that Paillier is secure against chosen-ciphertext attack. The original Paillier paper mentions that it is not. …

No, it is not possible to compute $\lambda$ easily. Specifically, if you have a black box that, given a random instance $c$, $c^\lambda \bmod n^2$, was able to recover $\lambda$ with nontrivial proba …

Actually, computing the inverse modulo $n^2$ using (say) the Extended Euclidean method is exactly what you do. If $c = g^m r^n \bmod n^2$ is an encrypted version of $m$, then $c^{-1} = (g^m r^n)^{-1} …

No, or at least, if you can, you have an Extremely Significant result; you've just shown that Paillier is a Fully Homomorphic system, and so it could perform any operation on encrypted data (and in a way … We don't believe that Paillier is an FHE system, hence either what you're asking for is infeasible, or we have a really exciting result on our hands. …

Yes (assuming $A$ knows the Paillier private key and $B$ knows the Paillier public key and the values of $x$ and $y$) With Pallier, someone with the public key can: Homomorpically multiply a ciphertext …

How can I modify the scheme so to make the correspondence between ciphertexts and plaintexts a one to one correspondece? You do realize that this would make encryption insecure, don't you? After …

Assuming that $D$ is the correct decryption, we have $$C = g^D r^n \pmod{n^2}$$ for some value $r$. Someone with the private key can easily recover $r$; hence they can just display it (and you can …

They're both additively homomorphic, but over different groups. With Goldwasser-Micali, you can, given $E(x)$ and $E(y)$, compute $E(x \oplus y)$ (where $\oplus$ is exclusive or) With Pallier, you c …

Does the problem of noise growth exist in the Paillier homomorphic scheme ? No, it does not. … Unlike Lattice-based schemes, you can do as many homomorphic additions as you want in Paillier (without doing anything like a "reboot"), and it's never a problem. …

Is it possible that the plaintext encrypted in a ciphertext using paillier encryption is positive without using a zero knowledge range proof? … If you are asking whether it is possible to test whether a Paillier-encrypted value is positive without the cooperation of the holder of the private key, well, we hope not. …

Well, the problem is with logical OR and subtraction (which Pallier can also do), you've got FHE; that is, you can compute any combinatorial function of encrypted (binary) inputs. Here's how it works …

My question is how is this attack avoided in FHE (fully homomorphic encryption) which allows arbitrary computations (e.g adding and comparing) on ciphertexts. We don't give attackers access to su …

As a result, $r \cdot r'$ may not be prime [2]; if this were a security risk, that means that you really couldn't use homomorphic addition (or, actually, Paillier at all, as an attacker could take your …

Are there other public key systems that do not have this property? A more cogent question might be "are there any public key systems other than RSA that does have this property?" In particular, …