Search Results

Contrary to what fgrieu said, I believe we can do a bit better for the case of multiplication modulo $n^2$. If we represent our values in the form $an+b$, $cn+d$ (where $0 \le a, b, c, d < n$), then w …

I wonder is it possible create by Zero Knowledge Proof to prove Two cipherTexts which are encrypted by same Public Key with Paillier Encryption has the same value inside but without decrypting the texts …

Is it possible that the plaintext encrypted in a ciphertext using paillier encryption is positive without using a zero knowledge range proof? … If you are asking whether it is possible to test whether a Paillier-encrypted value is positive without the cooperation of the holder of the private key, well, we hope not. …

You'd be fine - with Paillier, the attacker cannot retrieve any information from the ciphertext (assuming that the private key and the random values used during the encryption process is secure); even …

Is it yet proofed that Paillier is secure against chosen-ciphertext attack. The original Paillier paper mentions that it is not. …

Does the problem of noise growth exist in the Paillier homomorphic scheme ? No, it does not. … Unlike Lattice-based schemes, you can do as many homomorphic additions as you want in Paillier (without doing anything like a "reboot"), and it's never a problem. …

The outputs must exhibit additive homomorphism such that some operation on $f(a)$ and $f(b)$ will equal $f(a+b)$. Because $f$ is mandated to be nondeterministic, I assume that the requirement be …

It is certainly possible with Paillier. Here is one way: The (op) will be multiplication modulo $n$ the Paillier modulus (which is in the public key). … for values not relatively prime to $n$) We ask the encryptor to take $Am$ to compute $E(Am)$ To unmask, we compute $rinv = r^{-1} \bmod n$, and then homomorphically compute $E(rinv \cdot Am)$; this Paillier …

They're both additively homomorphic, but over different groups. With Goldwasser-Micali, you can, given $E(x)$ and $E(y)$, compute $E(x \oplus y)$ (where $\oplus$ is exclusive or) With Pallier, you c …

What is so difficult about this if $z=y^n\ mod\ n^2$ We don't know of an efficient way of solving it. That's essentially what we can say about just about any hard problem in cryptography. …

With Paillier, it's easy; generate a random encryption of 0 ($r^n \bmod n^2$ for random $r$ r.p to $n$), and then homomorphically add it to the encryption (that is, $C2 = C1 \cdot r^n \bmod n^2$), and …

Can [comparison] be done using homomorphic encryption? Not without interaction with the person with the private key. Suppose there was a possible way; given $E_k(a)$ and $E_k(b)$, one could dete …

Are there other public key systems that do not have this property? A more cogent question might be "are there any public key systems other than RSA that does have this property?" In particular, …

Assuming that $D$ is the correct decryption, we have $$C = g^D r^n \pmod{n^2}$$ for some value $r$. Someone with the private key can easily recover $r$; hence they can just display it (and you can …

How can I modify the scheme so to make the correspondence between ciphertexts and plaintexts a one to one correspondece? You do realize that this would make encryption insecure, don't you? After …