Homomorphic properties of Paillier












2












$begingroup$


I'm curious about the homomorphic properties of Paillier. So, basically if I have $textsf{Dec}(textsf{sk}, textsf{Enc}(textsf{pk}, alpha) cdot textsf{Enc}(textsf{pk}, alpha^{-1}))$, I will get as result $alpha + alpha^{-1}$. But, does it also mean that if I have $textsf{Dec}(textsf{sk}, textsf{Enc}(textsf{pk}, alpha)^{textsf{Enc}(textsf{pk}, alpha^{-1})})$, then the result will be $alpha cdot alpha^{-1}$, which will basically cancel each other, and will be left with 1?






encryption homomorphic-encryption paillier







share|improve this question









$endgroup$

















    2












    $begingroup$


    I'm curious about the homomorphic properties of Paillier. So, basically if I have $textsf{Dec}(textsf{sk}, textsf{Enc}(textsf{pk}, alpha) cdot textsf{Enc}(textsf{pk}, alpha^{-1}))$, I will get as result $alpha + alpha^{-1}$. But, does it also mean that if I have $textsf{Dec}(textsf{sk}, textsf{Enc}(textsf{pk}, alpha)^{textsf{Enc}(textsf{pk}, alpha^{-1})})$, then the result will be $alpha cdot alpha^{-1}$, which will basically cancel each other, and will be left with 1?






    encryption homomorphic-encryption paillier







    share|improve this question









    $endgroup$















      2












      2








      2





      $begingroup$


      I'm curious about the homomorphic properties of Paillier. So, basically if I have $textsf{Dec}(textsf{sk}, textsf{Enc}(textsf{pk}, alpha) cdot textsf{Enc}(textsf{pk}, alpha^{-1}))$, I will get as result $alpha + alpha^{-1}$. But, does it also mean that if I have $textsf{Dec}(textsf{sk}, textsf{Enc}(textsf{pk}, alpha)^{textsf{Enc}(textsf{pk}, alpha^{-1})})$, then the result will be $alpha cdot alpha^{-1}$, which will basically cancel each other, and will be left with 1?






      encryption homomorphic-encryption paillier







      share|improve this question









      $endgroup$




      I'm curious about the homomorphic properties of Paillier. So, basically if I have $textsf{Dec}(textsf{sk}, textsf{Enc}(textsf{pk}, alpha) cdot textsf{Enc}(textsf{pk}, alpha^{-1}))$, I will get as result $alpha + alpha^{-1}$. But, does it also mean that if I have $textsf{Dec}(textsf{sk}, textsf{Enc}(textsf{pk}, alpha)^{textsf{Enc}(textsf{pk}, alpha^{-1})})$, then the result will be $alpha cdot alpha^{-1}$, which will basically cancel each other, and will be left with 1?






      encryption homomorphic-encryption paillier




      encryption homomorphic-encryption paillier






      share|improve this question













      share|improve this question











      share|improve this question




      share|improve this question










      asked Nov 14 '18 at 10:04









      tinkertinker

      397310




      397310






















          2 Answers
          2






          active

          oldest

          votes


















          5












          $begingroup$

          No, there is no reason that $textsf{Dec}(textsf{sk}, textsf{Enc}(textsf{pk},alpha)^{textsf{Enc}(textsf{pk}, alpha^{-1})})$ would be $alphacdotalpha^{-1}$, including when we spread $bmod N$ or $bmod N^2$ here and there.



          What does apply is: for overwhelmingly most $alpha$ and $k$ in $Bbb Z$, it holds that $textsf{Dec}(textsf{sk},textsf{Enc}(textsf{pk}, alpha)^kbmod N^2)=kcdotalphabmod N$. We could take $k=alpha^{-1}bmod N$ and get $textsf{Dec}(textsf{sk},textsf{Enc}(textsf{pk},alpha)^{(alpha^{-1}bmod N)}bmod N^2)=1$, but that's not useful anyway, since $alpha^{-1}bmod N$ reveals $alphabmod N$.




          Criticism of the question:




          • It is not defined in which group it is computed $alpha^{-1}$, and that matters.


          • $textsf{Dec}(textsf{sk}, textsf{Enc}(textsf{pk}, alpha) cdot textsf{Enc}(textsf{pk}, alpha^{-1}))$ will be $alpha+alpha^{-1}bmod N$, which may or may not be $alpha+alpha^{-1}$.






          share|improve this answer











          $endgroup$





















            1












            $begingroup$

            Given two plaintexts $alpha$ and $beta$, Pailler cryptosystem $mathcal{E}$ homomotphic property is: $mathcal{E}(alpha)times mathcal{E}(beta)=mathcal{E}(alpha+beta)$. So, $mathcal{E}(alpha)^n=mathcal{E}(nalpha)$. In your example, $n=mathcal{E}(alpha^{-1})$ and thus after decryption you will have $mathcal{E}(alpha^{-1})times alpha$ ans not $alpha^{-1} times alpha$. This is a high level answer, but you need to define the modulo $N$ of your system.






            share|improve this answer









            $endgroup$













              Your Answer





              StackExchange.ifUsing("editor", function () {
              return StackExchange.using("mathjaxEditing", function () {
              StackExchange.MarkdownEditor.creationCallbacks.add(function (editor, postfix) {
              StackExchange.mathjaxEditing.prepareWmdForMathJax(editor, postfix, [["$", "$"], ["\\(","\\)"]]);
              });
              });
              }, "mathjax-editing");

              StackExchange.ready(function() {
              var channelOptions = {
              tags: "".split(" "),
              id: "281"
              };
              initTagRenderer("".split(" "), "".split(" "), channelOptions);

              StackExchange.using("externalEditor", function() {
              // Have to fire editor after snippets, if snippets enabled
              if (StackExchange.settings.snippets.snippetsEnabled) {
              StackExchange.using("snippets", function() {
              createEditor();
              });
              }
              else {
              createEditor();
              }
              });

              function createEditor() {
              StackExchange.prepareEditor({
              heartbeatType: 'answer',
              autoActivateHeartbeat: false,
              convertImagesToLinks: false,
              noModals: true,
              showLowRepImageUploadWarning: true,
              reputationToPostImages: null,
              bindNavPrevention: true,
              postfix: "",
              imageUploader: {
              brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
              contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
              allowUrls: true
              },
              noCode: true, onDemand: true,
              discardSelector: ".discard-answer"
              ,immediatelyShowMarkdownHelp:true
              });


              }
              });














              draft saved

              draft discarded


















              StackExchange.ready(
              function () {
              StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f63991%2fhomomorphic-properties-of-paillier%23new-answer', 'question_page');
              }
              );

              Post as a guest















              Required, but never shown

























              2 Answers
              2






              active

              oldest

              votes








              2 Answers
              2






              active

              oldest

              votes









              active

              oldest

              votes






              active

              oldest

              votes









              5












              $begingroup$

              No, there is no reason that $textsf{Dec}(textsf{sk}, textsf{Enc}(textsf{pk},alpha)^{textsf{Enc}(textsf{pk}, alpha^{-1})})$ would be $alphacdotalpha^{-1}$, including when we spread $bmod N$ or $bmod N^2$ here and there.



              What does apply is: for overwhelmingly most $alpha$ and $k$ in $Bbb Z$, it holds that $textsf{Dec}(textsf{sk},textsf{Enc}(textsf{pk}, alpha)^kbmod N^2)=kcdotalphabmod N$. We could take $k=alpha^{-1}bmod N$ and get $textsf{Dec}(textsf{sk},textsf{Enc}(textsf{pk},alpha)^{(alpha^{-1}bmod N)}bmod N^2)=1$, but that's not useful anyway, since $alpha^{-1}bmod N$ reveals $alphabmod N$.




              Criticism of the question:




              • It is not defined in which group it is computed $alpha^{-1}$, and that matters.


              • $textsf{Dec}(textsf{sk}, textsf{Enc}(textsf{pk}, alpha) cdot textsf{Enc}(textsf{pk}, alpha^{-1}))$ will be $alpha+alpha^{-1}bmod N$, which may or may not be $alpha+alpha^{-1}$.






              share|improve this answer











              $endgroup$


















                5












                $begingroup$

                No, there is no reason that $textsf{Dec}(textsf{sk}, textsf{Enc}(textsf{pk},alpha)^{textsf{Enc}(textsf{pk}, alpha^{-1})})$ would be $alphacdotalpha^{-1}$, including when we spread $bmod N$ or $bmod N^2$ here and there.



                What does apply is: for overwhelmingly most $alpha$ and $k$ in $Bbb Z$, it holds that $textsf{Dec}(textsf{sk},textsf{Enc}(textsf{pk}, alpha)^kbmod N^2)=kcdotalphabmod N$. We could take $k=alpha^{-1}bmod N$ and get $textsf{Dec}(textsf{sk},textsf{Enc}(textsf{pk},alpha)^{(alpha^{-1}bmod N)}bmod N^2)=1$, but that's not useful anyway, since $alpha^{-1}bmod N$ reveals $alphabmod N$.




                Criticism of the question:




                • It is not defined in which group it is computed $alpha^{-1}$, and that matters.


                • $textsf{Dec}(textsf{sk}, textsf{Enc}(textsf{pk}, alpha) cdot textsf{Enc}(textsf{pk}, alpha^{-1}))$ will be $alpha+alpha^{-1}bmod N$, which may or may not be $alpha+alpha^{-1}$.






                share|improve this answer











                $endgroup$
















                  5












                  5








                  5





                  $begingroup$

                  No, there is no reason that $textsf{Dec}(textsf{sk}, textsf{Enc}(textsf{pk},alpha)^{textsf{Enc}(textsf{pk}, alpha^{-1})})$ would be $alphacdotalpha^{-1}$, including when we spread $bmod N$ or $bmod N^2$ here and there.



                  What does apply is: for overwhelmingly most $alpha$ and $k$ in $Bbb Z$, it holds that $textsf{Dec}(textsf{sk},textsf{Enc}(textsf{pk}, alpha)^kbmod N^2)=kcdotalphabmod N$. We could take $k=alpha^{-1}bmod N$ and get $textsf{Dec}(textsf{sk},textsf{Enc}(textsf{pk},alpha)^{(alpha^{-1}bmod N)}bmod N^2)=1$, but that's not useful anyway, since $alpha^{-1}bmod N$ reveals $alphabmod N$.




                  Criticism of the question:




                  • It is not defined in which group it is computed $alpha^{-1}$, and that matters.


                  • $textsf{Dec}(textsf{sk}, textsf{Enc}(textsf{pk}, alpha) cdot textsf{Enc}(textsf{pk}, alpha^{-1}))$ will be $alpha+alpha^{-1}bmod N$, which may or may not be $alpha+alpha^{-1}$.






                  share|improve this answer











                  $endgroup$



                  No, there is no reason that $textsf{Dec}(textsf{sk}, textsf{Enc}(textsf{pk},alpha)^{textsf{Enc}(textsf{pk}, alpha^{-1})})$ would be $alphacdotalpha^{-1}$, including when we spread $bmod N$ or $bmod N^2$ here and there.



                  What does apply is: for overwhelmingly most $alpha$ and $k$ in $Bbb Z$, it holds that $textsf{Dec}(textsf{sk},textsf{Enc}(textsf{pk}, alpha)^kbmod N^2)=kcdotalphabmod N$. We could take $k=alpha^{-1}bmod N$ and get $textsf{Dec}(textsf{sk},textsf{Enc}(textsf{pk},alpha)^{(alpha^{-1}bmod N)}bmod N^2)=1$, but that's not useful anyway, since $alpha^{-1}bmod N$ reveals $alphabmod N$.




                  Criticism of the question:




                  • It is not defined in which group it is computed $alpha^{-1}$, and that matters.


                  • $textsf{Dec}(textsf{sk}, textsf{Enc}(textsf{pk}, alpha) cdot textsf{Enc}(textsf{pk}, alpha^{-1}))$ will be $alpha+alpha^{-1}bmod N$, which may or may not be $alpha+alpha^{-1}$.







                  share|improve this answer














                  share|improve this answer



                  share|improve this answer








                  edited Nov 15 '18 at 7:00

























                  answered Nov 14 '18 at 11:12









                  fgrieufgrieu

                  79.4k7169336




                  79.4k7169336























                      1












                      $begingroup$

                      Given two plaintexts $alpha$ and $beta$, Pailler cryptosystem $mathcal{E}$ homomotphic property is: $mathcal{E}(alpha)times mathcal{E}(beta)=mathcal{E}(alpha+beta)$. So, $mathcal{E}(alpha)^n=mathcal{E}(nalpha)$. In your example, $n=mathcal{E}(alpha^{-1})$ and thus after decryption you will have $mathcal{E}(alpha^{-1})times alpha$ ans not $alpha^{-1} times alpha$. This is a high level answer, but you need to define the modulo $N$ of your system.






                      share|improve this answer









                      $endgroup$


















                        1












                        $begingroup$

                        Given two plaintexts $alpha$ and $beta$, Pailler cryptosystem $mathcal{E}$ homomotphic property is: $mathcal{E}(alpha)times mathcal{E}(beta)=mathcal{E}(alpha+beta)$. So, $mathcal{E}(alpha)^n=mathcal{E}(nalpha)$. In your example, $n=mathcal{E}(alpha^{-1})$ and thus after decryption you will have $mathcal{E}(alpha^{-1})times alpha$ ans not $alpha^{-1} times alpha$. This is a high level answer, but you need to define the modulo $N$ of your system.






                        share|improve this answer









                        $endgroup$
















                          1












                          1








                          1





                          $begingroup$

                          Given two plaintexts $alpha$ and $beta$, Pailler cryptosystem $mathcal{E}$ homomotphic property is: $mathcal{E}(alpha)times mathcal{E}(beta)=mathcal{E}(alpha+beta)$. So, $mathcal{E}(alpha)^n=mathcal{E}(nalpha)$. In your example, $n=mathcal{E}(alpha^{-1})$ and thus after decryption you will have $mathcal{E}(alpha^{-1})times alpha$ ans not $alpha^{-1} times alpha$. This is a high level answer, but you need to define the modulo $N$ of your system.






                          share|improve this answer









                          $endgroup$



                          Given two plaintexts $alpha$ and $beta$, Pailler cryptosystem $mathcal{E}$ homomotphic property is: $mathcal{E}(alpha)times mathcal{E}(beta)=mathcal{E}(alpha+beta)$. So, $mathcal{E}(alpha)^n=mathcal{E}(nalpha)$. In your example, $n=mathcal{E}(alpha^{-1})$ and thus after decryption you will have $mathcal{E}(alpha^{-1})times alpha$ ans not $alpha^{-1} times alpha$. This is a high level answer, but you need to define the modulo $N$ of your system.







                          share|improve this answer












                          share|improve this answer



                          share|improve this answer










                          answered Nov 14 '18 at 11:12









                          Youssef El HousniYoussef El Housni

                          52938




                          52938






























                              draft saved

                              draft discarded




















































                              Thanks for contributing an answer to Cryptography Stack Exchange!


                              • Please be sure to answer the question. Provide details and share your research!

                              But avoid …



                              • Asking for help, clarification, or responding to other answers.

                              • Making statements based on opinion; back them up with references or personal experience.


                              Use MathJax to format equations. MathJax reference.


                              To learn more, see our tips on writing great answers.




                              draft saved


                              draft discarded














                              StackExchange.ready(
                              function () {
                              StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f63991%2fhomomorphic-properties-of-paillier%23new-answer', 'question_page');
                              }
                              );

                              Post as a guest















                              Required, but never shown





















































                              Required, but never shown














                              Required, but never shown












                              Required, but never shown







                              Required, but never shown

































                              Required, but never shown














                              Required, but never shown












                              Required, but never shown







                              Required, but never shown







                              -

                              Popular posts from this blog

                              Bressuire

                              Image
                              Subprefecture and commune in Nouvelle-Aquitaine, France Bressuire Subprefecture and commune Chateau de Bressuire and the Eglise Notre-Dame Coat of arms Location of Bressuire Bressuire Show map of France Bressuire Show map of Nouvelle-Aquitaine Coordinates: 46°50′27″N 0°29′14″W  /  46.8408°N 0.4872°W  / 46.8408; -0.4872 Coordinates: 46°50′27″N 0°29′14″W  /  46.8408°N 0.4872°W  / 46.8408; -0.4872 Country France Region Nouvelle-Aquitaine Department Deux-Sèvres Arrondissement Bressuire Canton Bressuire Government  • Mayor .mw-parser-output .nobold{font-weight:normal} (2014–20) Jean Michel Bernier Area 1 180.59 km 2 (69.73 sq mi) Population (2014) 2 19,300  • Density 110/km 2 (280/sq mi) Time zone UTC+01:00 (CET)  • Summer (DST) UTC+02:00 (CEST) INSEE/Postal code 79049 /79300 Elevation 98–236 m (322–774 ft) (avg. 173 m or 568 ft) 1 French Land Register data, which exclude
                              Read more

                              Vorschmack

                              Image
                              Vorschmack Ukrainian Jewish-style vorschmack served on rye bread Course Hors d'oeuvre Region or state Eastern Europe Associated national cuisine Ashkenazi Jewish, Finnish, German, Ukrainian, Polish, Russian Main ingredients Ground meat and/or fish Cookbook: Vorschmack   Media: Vorschmack Vorschmack or forshmak (Yiddish: פֿאָרשמאַק ‎, from archaic German Vorschmack , "foretaste" [1] or "appetizer" [2] ) is an originally East European dish made of salty minced fish or meat. Different variants of this dish are especially common in Ashkenazi Jewish and Finnish cuisine. Some varieties are also known in Russian and Polish cuisine. Contents 1 In Jewish cuisine 2 In Russian cuisine 3 In Polish cuisine 4 In Finnish cuisine 5 See also 6 References In Jewish cuisine According to Gil Marks, the German name points to the possible Germanic origin of this dish. [1] William Pokhlyobkin descr
                              Read more

                              Quarantine

                              Image
                              For other uses, see Quarantine (disambiguation). Signal flag "Lima" called the "Yellow Jack" which when flown in harbor means ship is under quarantine. A simple yellow flag (also called the "Yellow Jack") had historically been used to signal quarantine (it stands for Q among signal flags), but now indicates the opposite, as a signal of a ship free of disease that requests boarding and inspection. A quarantine is used to separate and restrict the movement of people; it is 'a restraint upon the activities or communication of persons or the transport of goods designed to prevent the spread of disease or pests', for a certain period of time. [1] This is often used in connection to disease and illness, such as those who may possibly have been exposed to a communicable disease. [2] The term is often erroneously used to mean medical isolation, which is "to separate ill persons who have a communicable disease from those who are healthy
                              Read more