Homomorphic properties of Paillier












2












$begingroup$


I'm curious about the homomorphic properties of Paillier. So, basically if I have $textsf{Dec}(textsf{sk}, textsf{Enc}(textsf{pk}, alpha) cdot textsf{Enc}(textsf{pk}, alpha^{-1}))$, I will get as result $alpha + alpha^{-1}$. But, does it also mean that if I have $textsf{Dec}(textsf{sk}, textsf{Enc}(textsf{pk}, alpha)^{textsf{Enc}(textsf{pk}, alpha^{-1})})$, then the result will be $alpha cdot alpha^{-1}$, which will basically cancel each other, and will be left with 1?






encryption homomorphic-encryption paillier







share|improve this question









$endgroup$

















    2












    $begingroup$


    I'm curious about the homomorphic properties of Paillier. So, basically if I have $textsf{Dec}(textsf{sk}, textsf{Enc}(textsf{pk}, alpha) cdot textsf{Enc}(textsf{pk}, alpha^{-1}))$, I will get as result $alpha + alpha^{-1}$. But, does it also mean that if I have $textsf{Dec}(textsf{sk}, textsf{Enc}(textsf{pk}, alpha)^{textsf{Enc}(textsf{pk}, alpha^{-1})})$, then the result will be $alpha cdot alpha^{-1}$, which will basically cancel each other, and will be left with 1?






    encryption homomorphic-encryption paillier







    share|improve this question









    $endgroup$















      2












      2








      2





      $begingroup$


      I'm curious about the homomorphic properties of Paillier. So, basically if I have $textsf{Dec}(textsf{sk}, textsf{Enc}(textsf{pk}, alpha) cdot textsf{Enc}(textsf{pk}, alpha^{-1}))$, I will get as result $alpha + alpha^{-1}$. But, does it also mean that if I have $textsf{Dec}(textsf{sk}, textsf{Enc}(textsf{pk}, alpha)^{textsf{Enc}(textsf{pk}, alpha^{-1})})$, then the result will be $alpha cdot alpha^{-1}$, which will basically cancel each other, and will be left with 1?






      encryption homomorphic-encryption paillier







      share|improve this question









      $endgroup$




      I'm curious about the homomorphic properties of Paillier. So, basically if I have $textsf{Dec}(textsf{sk}, textsf{Enc}(textsf{pk}, alpha) cdot textsf{Enc}(textsf{pk}, alpha^{-1}))$, I will get as result $alpha + alpha^{-1}$. But, does it also mean that if I have $textsf{Dec}(textsf{sk}, textsf{Enc}(textsf{pk}, alpha)^{textsf{Enc}(textsf{pk}, alpha^{-1})})$, then the result will be $alpha cdot alpha^{-1}$, which will basically cancel each other, and will be left with 1?






      encryption homomorphic-encryption paillier




      encryption homomorphic-encryption paillier






      share|improve this question













      share|improve this question











      share|improve this question




      share|improve this question










      asked Nov 14 '18 at 10:04









      tinkertinker

      397310




      397310






















          2 Answers
          2






          active

          oldest

          votes


















          5












          $begingroup$

          No, there is no reason that $textsf{Dec}(textsf{sk}, textsf{Enc}(textsf{pk},alpha)^{textsf{Enc}(textsf{pk}, alpha^{-1})})$ would be $alphacdotalpha^{-1}$, including when we spread $bmod N$ or $bmod N^2$ here and there.



          What does apply is: for overwhelmingly most $alpha$ and $k$ in $Bbb Z$, it holds that $textsf{Dec}(textsf{sk},textsf{Enc}(textsf{pk}, alpha)^kbmod N^2)=kcdotalphabmod N$. We could take $k=alpha^{-1}bmod N$ and get $textsf{Dec}(textsf{sk},textsf{Enc}(textsf{pk},alpha)^{(alpha^{-1}bmod N)}bmod N^2)=1$, but that's not useful anyway, since $alpha^{-1}bmod N$ reveals $alphabmod N$.




          Criticism of the question:




          • It is not defined in which group it is computed $alpha^{-1}$, and that matters.


          • $textsf{Dec}(textsf{sk}, textsf{Enc}(textsf{pk}, alpha) cdot textsf{Enc}(textsf{pk}, alpha^{-1}))$ will be $alpha+alpha^{-1}bmod N$, which may or may not be $alpha+alpha^{-1}$.






          share|improve this answer











          $endgroup$





















            1












            $begingroup$

            Given two plaintexts $alpha$ and $beta$, Pailler cryptosystem $mathcal{E}$ homomotphic property is: $mathcal{E}(alpha)times mathcal{E}(beta)=mathcal{E}(alpha+beta)$. So, $mathcal{E}(alpha)^n=mathcal{E}(nalpha)$. In your example, $n=mathcal{E}(alpha^{-1})$ and thus after decryption you will have $mathcal{E}(alpha^{-1})times alpha$ ans not $alpha^{-1} times alpha$. This is a high level answer, but you need to define the modulo $N$ of your system.






            share|improve this answer









            $endgroup$













              Your Answer





              StackExchange.ifUsing("editor", function () {
              return StackExchange.using("mathjaxEditing", function () {
              StackExchange.MarkdownEditor.creationCallbacks.add(function (editor, postfix) {
              StackExchange.mathjaxEditing.prepareWmdForMathJax(editor, postfix, [["$", "$"], ["\\(","\\)"]]);
              });
              });
              }, "mathjax-editing");

              StackExchange.ready(function() {
              var channelOptions = {
              tags: "".split(" "),
              id: "281"
              };
              initTagRenderer("".split(" "), "".split(" "), channelOptions);

              StackExchange.using("externalEditor", function() {
              // Have to fire editor after snippets, if snippets enabled
              if (StackExchange.settings.snippets.snippetsEnabled) {
              StackExchange.using("snippets", function() {
              createEditor();
              });
              }
              else {
              createEditor();
              }
              });

              function createEditor() {
              StackExchange.prepareEditor({
              heartbeatType: 'answer',
              autoActivateHeartbeat: false,
              convertImagesToLinks: false,
              noModals: true,
              showLowRepImageUploadWarning: true,
              reputationToPostImages: null,
              bindNavPrevention: true,
              postfix: "",
              imageUploader: {
              brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
              contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
              allowUrls: true
              },
              noCode: true, onDemand: true,
              discardSelector: ".discard-answer"
              ,immediatelyShowMarkdownHelp:true
              });


              }
              });














              draft saved

              draft discarded


















              StackExchange.ready(
              function () {
              StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f63991%2fhomomorphic-properties-of-paillier%23new-answer', 'question_page');
              }
              );

              Post as a guest















              Required, but never shown

























              2 Answers
              2






              active

              oldest

              votes








              2 Answers
              2






              active

              oldest

              votes









              active

              oldest

              votes






              active

              oldest

              votes









              5












              $begingroup$

              No, there is no reason that $textsf{Dec}(textsf{sk}, textsf{Enc}(textsf{pk},alpha)^{textsf{Enc}(textsf{pk}, alpha^{-1})})$ would be $alphacdotalpha^{-1}$, including when we spread $bmod N$ or $bmod N^2$ here and there.



              What does apply is: for overwhelmingly most $alpha$ and $k$ in $Bbb Z$, it holds that $textsf{Dec}(textsf{sk},textsf{Enc}(textsf{pk}, alpha)^kbmod N^2)=kcdotalphabmod N$. We could take $k=alpha^{-1}bmod N$ and get $textsf{Dec}(textsf{sk},textsf{Enc}(textsf{pk},alpha)^{(alpha^{-1}bmod N)}bmod N^2)=1$, but that's not useful anyway, since $alpha^{-1}bmod N$ reveals $alphabmod N$.




              Criticism of the question:




              • It is not defined in which group it is computed $alpha^{-1}$, and that matters.


              • $textsf{Dec}(textsf{sk}, textsf{Enc}(textsf{pk}, alpha) cdot textsf{Enc}(textsf{pk}, alpha^{-1}))$ will be $alpha+alpha^{-1}bmod N$, which may or may not be $alpha+alpha^{-1}$.






              share|improve this answer











              $endgroup$


















                5












                $begingroup$

                No, there is no reason that $textsf{Dec}(textsf{sk}, textsf{Enc}(textsf{pk},alpha)^{textsf{Enc}(textsf{pk}, alpha^{-1})})$ would be $alphacdotalpha^{-1}$, including when we spread $bmod N$ or $bmod N^2$ here and there.



                What does apply is: for overwhelmingly most $alpha$ and $k$ in $Bbb Z$, it holds that $textsf{Dec}(textsf{sk},textsf{Enc}(textsf{pk}, alpha)^kbmod N^2)=kcdotalphabmod N$. We could take $k=alpha^{-1}bmod N$ and get $textsf{Dec}(textsf{sk},textsf{Enc}(textsf{pk},alpha)^{(alpha^{-1}bmod N)}bmod N^2)=1$, but that's not useful anyway, since $alpha^{-1}bmod N$ reveals $alphabmod N$.




                Criticism of the question:




                • It is not defined in which group it is computed $alpha^{-1}$, and that matters.


                • $textsf{Dec}(textsf{sk}, textsf{Enc}(textsf{pk}, alpha) cdot textsf{Enc}(textsf{pk}, alpha^{-1}))$ will be $alpha+alpha^{-1}bmod N$, which may or may not be $alpha+alpha^{-1}$.






                share|improve this answer











                $endgroup$
















                  5












                  5








                  5





                  $begingroup$

                  No, there is no reason that $textsf{Dec}(textsf{sk}, textsf{Enc}(textsf{pk},alpha)^{textsf{Enc}(textsf{pk}, alpha^{-1})})$ would be $alphacdotalpha^{-1}$, including when we spread $bmod N$ or $bmod N^2$ here and there.



                  What does apply is: for overwhelmingly most $alpha$ and $k$ in $Bbb Z$, it holds that $textsf{Dec}(textsf{sk},textsf{Enc}(textsf{pk}, alpha)^kbmod N^2)=kcdotalphabmod N$. We could take $k=alpha^{-1}bmod N$ and get $textsf{Dec}(textsf{sk},textsf{Enc}(textsf{pk},alpha)^{(alpha^{-1}bmod N)}bmod N^2)=1$, but that's not useful anyway, since $alpha^{-1}bmod N$ reveals $alphabmod N$.




                  Criticism of the question:




                  • It is not defined in which group it is computed $alpha^{-1}$, and that matters.


                  • $textsf{Dec}(textsf{sk}, textsf{Enc}(textsf{pk}, alpha) cdot textsf{Enc}(textsf{pk}, alpha^{-1}))$ will be $alpha+alpha^{-1}bmod N$, which may or may not be $alpha+alpha^{-1}$.






                  share|improve this answer











                  $endgroup$



                  No, there is no reason that $textsf{Dec}(textsf{sk}, textsf{Enc}(textsf{pk},alpha)^{textsf{Enc}(textsf{pk}, alpha^{-1})})$ would be $alphacdotalpha^{-1}$, including when we spread $bmod N$ or $bmod N^2$ here and there.



                  What does apply is: for overwhelmingly most $alpha$ and $k$ in $Bbb Z$, it holds that $textsf{Dec}(textsf{sk},textsf{Enc}(textsf{pk}, alpha)^kbmod N^2)=kcdotalphabmod N$. We could take $k=alpha^{-1}bmod N$ and get $textsf{Dec}(textsf{sk},textsf{Enc}(textsf{pk},alpha)^{(alpha^{-1}bmod N)}bmod N^2)=1$, but that's not useful anyway, since $alpha^{-1}bmod N$ reveals $alphabmod N$.




                  Criticism of the question:




                  • It is not defined in which group it is computed $alpha^{-1}$, and that matters.


                  • $textsf{Dec}(textsf{sk}, textsf{Enc}(textsf{pk}, alpha) cdot textsf{Enc}(textsf{pk}, alpha^{-1}))$ will be $alpha+alpha^{-1}bmod N$, which may or may not be $alpha+alpha^{-1}$.







                  share|improve this answer














                  share|improve this answer



                  share|improve this answer








                  edited Nov 15 '18 at 7:00

























                  answered Nov 14 '18 at 11:12









                  fgrieufgrieu

                  79.4k7169336




                  79.4k7169336























                      1












                      $begingroup$

                      Given two plaintexts $alpha$ and $beta$, Pailler cryptosystem $mathcal{E}$ homomotphic property is: $mathcal{E}(alpha)times mathcal{E}(beta)=mathcal{E}(alpha+beta)$. So, $mathcal{E}(alpha)^n=mathcal{E}(nalpha)$. In your example, $n=mathcal{E}(alpha^{-1})$ and thus after decryption you will have $mathcal{E}(alpha^{-1})times alpha$ ans not $alpha^{-1} times alpha$. This is a high level answer, but you need to define the modulo $N$ of your system.






                      share|improve this answer









                      $endgroup$


















                        1












                        $begingroup$

                        Given two plaintexts $alpha$ and $beta$, Pailler cryptosystem $mathcal{E}$ homomotphic property is: $mathcal{E}(alpha)times mathcal{E}(beta)=mathcal{E}(alpha+beta)$. So, $mathcal{E}(alpha)^n=mathcal{E}(nalpha)$. In your example, $n=mathcal{E}(alpha^{-1})$ and thus after decryption you will have $mathcal{E}(alpha^{-1})times alpha$ ans not $alpha^{-1} times alpha$. This is a high level answer, but you need to define the modulo $N$ of your system.






                        share|improve this answer









                        $endgroup$
















                          1












                          1








                          1





                          $begingroup$

                          Given two plaintexts $alpha$ and $beta$, Pailler cryptosystem $mathcal{E}$ homomotphic property is: $mathcal{E}(alpha)times mathcal{E}(beta)=mathcal{E}(alpha+beta)$. So, $mathcal{E}(alpha)^n=mathcal{E}(nalpha)$. In your example, $n=mathcal{E}(alpha^{-1})$ and thus after decryption you will have $mathcal{E}(alpha^{-1})times alpha$ ans not $alpha^{-1} times alpha$. This is a high level answer, but you need to define the modulo $N$ of your system.






                          share|improve this answer









                          $endgroup$



                          Given two plaintexts $alpha$ and $beta$, Pailler cryptosystem $mathcal{E}$ homomotphic property is: $mathcal{E}(alpha)times mathcal{E}(beta)=mathcal{E}(alpha+beta)$. So, $mathcal{E}(alpha)^n=mathcal{E}(nalpha)$. In your example, $n=mathcal{E}(alpha^{-1})$ and thus after decryption you will have $mathcal{E}(alpha^{-1})times alpha$ ans not $alpha^{-1} times alpha$. This is a high level answer, but you need to define the modulo $N$ of your system.







                          share|improve this answer












                          share|improve this answer



                          share|improve this answer










                          answered Nov 14 '18 at 11:12









                          Youssef El HousniYoussef El Housni

                          52938




                          52938






























                              draft saved

                              draft discarded




















































                              Thanks for contributing an answer to Cryptography Stack Exchange!


                              • Please be sure to answer the question. Provide details and share your research!

                              But avoid …



                              • Asking for help, clarification, or responding to other answers.

                              • Making statements based on opinion; back them up with references or personal experience.


                              Use MathJax to format equations. MathJax reference.


                              To learn more, see our tips on writing great answers.




                              draft saved


                              draft discarded














                              StackExchange.ready(
                              function () {
                              StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f63991%2fhomomorphic-properties-of-paillier%23new-answer', 'question_page');
                              }
                              );

                              Post as a guest















                              Required, but never shown





















































                              Required, but never shown














                              Required, but never shown












                              Required, but never shown







                              Required, but never shown

































                              Required, but never shown














                              Required, but never shown












                              Required, but never shown







                              Required, but never shown







                              -

                              Popular posts from this blog

                              Xamarin.iOS Cant Deploy on Iphone

                              Image
                              .everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ height:90px;width:728px;box-sizing:border-box; } -1 I have a windows laptop and a mac mini my problem is that It wont deploy on iphone if I use Visual Studio Xamarin on windows to install my app, but it works fine with Visual Studio For Mac. Here's what I get after build succeded on Visual Studio Xamarin on windows : 1>------ Build started: Project: FinalCustomerApp.iOS, Configuration: Debug iPhone ------ 1> Connecting to Mac server 192.168.8.100... 1> FinalCustomerApp.iOS -> C:UsersJeremy PaulDesktopFinalCustomerAppFinalCustomerAppFinalCustomerApp.iOSbiniPhoneDebugFinalCustomerApp.iOS.exe 1> Detected signing identity: 1> Code Signing Key: &quo
                              Read more

                              Glorious Revolution

                              Image
                              "The Bloodless Revolution" redirects here. For a history of the vegetarian movement, see The Bloodless Revolution (book). This article is about the English revolution of 1688. For the revolution of 1868 in Spain, see Glorious Revolution (Spain). For other uses, see Glorious Revolution (disambiguation). Glorious Revolution The Prince of Orange lands at Torbay Date 1688–1689 Location British Isles Also known as Revolution of 1688 War of the English Succession Bloodless Revolution Participants English, Welsh and Scottish society, Dutch forces Outcome Replacement of James II by William III and Mary II Jacobite rising of 1689 Williamite War in Ireland War with France; England and Scotland join Grand Alliance Drafting of the Bill of Rights 1689 Part of a series on the History of England Timeline Prehistoric Britain Roman Britain Sub-Roman Britain Medieval period Economy in the Middle Ages Anglo-Saxon period
                              Read more

                              Dulmage-Mendelsohn matrix decomposition in Python

                              Image
                              0 Matlab has a function called dmperm that computes the so-called Dulmage–Mendelsohn decomposition of a n x n matrix. From wikipedia, the Dulmage–Mendelsohn is a partition of the vertices of a bipartite graph into subsets, with the property that two adjacent vertices belong to the same subset if and only if they are paired with each other in a perfect matching of the graph. Looking both on scipy and numpy, I could not find this function, nor some similar version. Is it possible to implement it using basic linear algebra operations? Any idea if this is implemented in some Python package? python matlab linear-algebra graph-theory matrix-decomposition share | improve this question
                              Read more