Homomorphic properties of Paillier

The name of the pictureThe name of the pictureThe name of the pictureClash Royale CLAN TAG#URR8PPP











up vote
2
down vote

favorite












I'm curious about the homomorphic properties of Paillier. So, basically if I have $textsfDec(textsfsk, textsfEnc(textsfpk, alpha) cdot textsfEnc(textsfpk, alpha^-1))$, I will get as result $alpha + alpha^-1$. But, does it also mean that if I have $textsfDec(textsfsk, textsfEnc(textsfpk, alpha)^textsfEnc(textsfpk, alpha^-1))$, then the result will be $alpha cdot alpha^-1$, which will basically cancel each other, and will be left with 1?










share|improve this question





















  • @kelalaka What you mean?
    – tinker
    yesterday














up vote
2
down vote

favorite












I'm curious about the homomorphic properties of Paillier. So, basically if I have $textsfDec(textsfsk, textsfEnc(textsfpk, alpha) cdot textsfEnc(textsfpk, alpha^-1))$, I will get as result $alpha + alpha^-1$. But, does it also mean that if I have $textsfDec(textsfsk, textsfEnc(textsfpk, alpha)^textsfEnc(textsfpk, alpha^-1))$, then the result will be $alpha cdot alpha^-1$, which will basically cancel each other, and will be left with 1?










share|improve this question





















  • @kelalaka What you mean?
    – tinker
    yesterday












up vote
2
down vote

favorite









up vote
2
down vote

favorite











I'm curious about the homomorphic properties of Paillier. So, basically if I have $textsfDec(textsfsk, textsfEnc(textsfpk, alpha) cdot textsfEnc(textsfpk, alpha^-1))$, I will get as result $alpha + alpha^-1$. But, does it also mean that if I have $textsfDec(textsfsk, textsfEnc(textsfpk, alpha)^textsfEnc(textsfpk, alpha^-1))$, then the result will be $alpha cdot alpha^-1$, which will basically cancel each other, and will be left with 1?










share|improve this question













I'm curious about the homomorphic properties of Paillier. So, basically if I have $textsfDec(textsfsk, textsfEnc(textsfpk, alpha) cdot textsfEnc(textsfpk, alpha^-1))$, I will get as result $alpha + alpha^-1$. But, does it also mean that if I have $textsfDec(textsfsk, textsfEnc(textsfpk, alpha)^textsfEnc(textsfpk, alpha^-1))$, then the result will be $alpha cdot alpha^-1$, which will basically cancel each other, and will be left with 1?







encryption homomorphic-encryption paillier






share|improve this question













share|improve this question











share|improve this question




share|improve this question










asked yesterday









tinker

30127




30127











  • @kelalaka What you mean?
    – tinker
    yesterday
















  • @kelalaka What you mean?
    – tinker
    yesterday















@kelalaka What you mean?
– tinker
yesterday




@kelalaka What you mean?
– tinker
yesterday










2 Answers
2






active

oldest

votes

















up vote
4
down vote



accepted










No, there is no reason that $textsfDec(textsfsk, textsfEnc(textsfpk,alpha)^textsfEnc(textsfpk, alpha^-1))$ would be $alphacdotalpha^-1$, including when we spread $bmod N$ or $bmod N^2$ here and there.



What does apply is: for overwhelmingly most $alpha$ and $k$ in $Bbb Z$, it holds that $textsfDec(textsfsk,textsfEnc(textsfpk, alpha)^kbmod N^2)=kcdotalphabmod N$. We could take $k=alpha^-1bmod N$ and get $textsfDec(textsfsk,textsfEnc(textsfpk,alpha)^(alpha^-1bmod N)bmod N^2)=1$, but that's not useful anyway, since $alpha^-1bmod N$ reveals $alphabmod N$.




Criticism of the question:



  • It is not defined in which group it is computed $alpha^-1$, and that matters.


  • $textsfDec(textsfsk, textsfEnc(textsfpk, alpha) cdot textsfEnc(textsfpk, alpha^-1))$ will be $alpha+alpha^-1bmod N$, which may or may not be $alpha+alpha^-1$.





share|improve this answer






















  • Thanks for the clarification.
    – tinker
    yesterday

















up vote
1
down vote













Given two plaintexts $alpha$ and $beta$, Pailler cryptosystem $mathcalE$ homomotphic property is: $mathcalE(alpha)times mathcalE(beta)=mathcalE(alpha+beta)$. So, $mathcalE(alpha)^n=mathcalE(nalpha)$. In your example, $n=mathcalE(alpha^-1)$ and thus after decryption you will have $mathcalE(alpha^-1)times alpha$ ans not $alpha^-1 times alpha$. This is a high level answer, but you need to define the modulo $N$ of your system.






share|improve this answer








New contributor




Youssef El Housni is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

















    Your Answer





    StackExchange.ifUsing("editor", function ()
    return StackExchange.using("mathjaxEditing", function ()
    StackExchange.MarkdownEditor.creationCallbacks.add(function (editor, postfix)
    StackExchange.mathjaxEditing.prepareWmdForMathJax(editor, postfix, [["$", "$"], ["\\(","\\)"]]);
    );
    );
    , "mathjax-editing");

    StackExchange.ready(function()
    var channelOptions =
    tags: "".split(" "),
    id: "281"
    ;
    initTagRenderer("".split(" "), "".split(" "), channelOptions);

    StackExchange.using("externalEditor", function()
    // Have to fire editor after snippets, if snippets enabled
    if (StackExchange.settings.snippets.snippetsEnabled)
    StackExchange.using("snippets", function()
    createEditor();
    );

    else
    createEditor();

    );

    function createEditor()
    StackExchange.prepareEditor(
    heartbeatType: 'answer',
    convertImagesToLinks: false,
    noModals: true,
    showLowRepImageUploadWarning: true,
    reputationToPostImages: null,
    bindNavPrevention: true,
    postfix: "",
    imageUploader:
    brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
    contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
    allowUrls: true
    ,
    noCode: true, onDemand: true,
    discardSelector: ".discard-answer"
    ,immediatelyShowMarkdownHelp:true
    );



    );













     

    draft saved


    draft discarded


















    StackExchange.ready(
    function ()
    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f63991%2fhomomorphic-properties-of-paillier%23new-answer', 'question_page');

    );

    Post as a guest















    Required, but never shown

























    2 Answers
    2






    active

    oldest

    votes








    2 Answers
    2






    active

    oldest

    votes









    active

    oldest

    votes






    active

    oldest

    votes








    up vote
    4
    down vote



    accepted










    No, there is no reason that $textsfDec(textsfsk, textsfEnc(textsfpk,alpha)^textsfEnc(textsfpk, alpha^-1))$ would be $alphacdotalpha^-1$, including when we spread $bmod N$ or $bmod N^2$ here and there.



    What does apply is: for overwhelmingly most $alpha$ and $k$ in $Bbb Z$, it holds that $textsfDec(textsfsk,textsfEnc(textsfpk, alpha)^kbmod N^2)=kcdotalphabmod N$. We could take $k=alpha^-1bmod N$ and get $textsfDec(textsfsk,textsfEnc(textsfpk,alpha)^(alpha^-1bmod N)bmod N^2)=1$, but that's not useful anyway, since $alpha^-1bmod N$ reveals $alphabmod N$.




    Criticism of the question:



    • It is not defined in which group it is computed $alpha^-1$, and that matters.


    • $textsfDec(textsfsk, textsfEnc(textsfpk, alpha) cdot textsfEnc(textsfpk, alpha^-1))$ will be $alpha+alpha^-1bmod N$, which may or may not be $alpha+alpha^-1$.





    share|improve this answer






















    • Thanks for the clarification.
      – tinker
      yesterday














    up vote
    4
    down vote



    accepted










    No, there is no reason that $textsfDec(textsfsk, textsfEnc(textsfpk,alpha)^textsfEnc(textsfpk, alpha^-1))$ would be $alphacdotalpha^-1$, including when we spread $bmod N$ or $bmod N^2$ here and there.



    What does apply is: for overwhelmingly most $alpha$ and $k$ in $Bbb Z$, it holds that $textsfDec(textsfsk,textsfEnc(textsfpk, alpha)^kbmod N^2)=kcdotalphabmod N$. We could take $k=alpha^-1bmod N$ and get $textsfDec(textsfsk,textsfEnc(textsfpk,alpha)^(alpha^-1bmod N)bmod N^2)=1$, but that's not useful anyway, since $alpha^-1bmod N$ reveals $alphabmod N$.




    Criticism of the question:



    • It is not defined in which group it is computed $alpha^-1$, and that matters.


    • $textsfDec(textsfsk, textsfEnc(textsfpk, alpha) cdot textsfEnc(textsfpk, alpha^-1))$ will be $alpha+alpha^-1bmod N$, which may or may not be $alpha+alpha^-1$.





    share|improve this answer






















    • Thanks for the clarification.
      – tinker
      yesterday












    up vote
    4
    down vote



    accepted







    up vote
    4
    down vote



    accepted






    No, there is no reason that $textsfDec(textsfsk, textsfEnc(textsfpk,alpha)^textsfEnc(textsfpk, alpha^-1))$ would be $alphacdotalpha^-1$, including when we spread $bmod N$ or $bmod N^2$ here and there.



    What does apply is: for overwhelmingly most $alpha$ and $k$ in $Bbb Z$, it holds that $textsfDec(textsfsk,textsfEnc(textsfpk, alpha)^kbmod N^2)=kcdotalphabmod N$. We could take $k=alpha^-1bmod N$ and get $textsfDec(textsfsk,textsfEnc(textsfpk,alpha)^(alpha^-1bmod N)bmod N^2)=1$, but that's not useful anyway, since $alpha^-1bmod N$ reveals $alphabmod N$.




    Criticism of the question:



    • It is not defined in which group it is computed $alpha^-1$, and that matters.


    • $textsfDec(textsfsk, textsfEnc(textsfpk, alpha) cdot textsfEnc(textsfpk, alpha^-1))$ will be $alpha+alpha^-1bmod N$, which may or may not be $alpha+alpha^-1$.





    share|improve this answer














    No, there is no reason that $textsfDec(textsfsk, textsfEnc(textsfpk,alpha)^textsfEnc(textsfpk, alpha^-1))$ would be $alphacdotalpha^-1$, including when we spread $bmod N$ or $bmod N^2$ here and there.



    What does apply is: for overwhelmingly most $alpha$ and $k$ in $Bbb Z$, it holds that $textsfDec(textsfsk,textsfEnc(textsfpk, alpha)^kbmod N^2)=kcdotalphabmod N$. We could take $k=alpha^-1bmod N$ and get $textsfDec(textsfsk,textsfEnc(textsfpk,alpha)^(alpha^-1bmod N)bmod N^2)=1$, but that's not useful anyway, since $alpha^-1bmod N$ reveals $alphabmod N$.




    Criticism of the question:



    • It is not defined in which group it is computed $alpha^-1$, and that matters.


    • $textsfDec(textsfsk, textsfEnc(textsfpk, alpha) cdot textsfEnc(textsfpk, alpha^-1))$ will be $alpha+alpha^-1bmod N$, which may or may not be $alpha+alpha^-1$.






    share|improve this answer














    share|improve this answer



    share|improve this answer








    edited 18 hours ago

























    answered yesterday









    fgrieu

    76.2k7155320




    76.2k7155320











    • Thanks for the clarification.
      – tinker
      yesterday
















    • Thanks for the clarification.
      – tinker
      yesterday















    Thanks for the clarification.
    – tinker
    yesterday




    Thanks for the clarification.
    – tinker
    yesterday










    up vote
    1
    down vote













    Given two plaintexts $alpha$ and $beta$, Pailler cryptosystem $mathcalE$ homomotphic property is: $mathcalE(alpha)times mathcalE(beta)=mathcalE(alpha+beta)$. So, $mathcalE(alpha)^n=mathcalE(nalpha)$. In your example, $n=mathcalE(alpha^-1)$ and thus after decryption you will have $mathcalE(alpha^-1)times alpha$ ans not $alpha^-1 times alpha$. This is a high level answer, but you need to define the modulo $N$ of your system.






    share|improve this answer








    New contributor




    Youssef El Housni is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
    Check out our Code of Conduct.





















      up vote
      1
      down vote













      Given two plaintexts $alpha$ and $beta$, Pailler cryptosystem $mathcalE$ homomotphic property is: $mathcalE(alpha)times mathcalE(beta)=mathcalE(alpha+beta)$. So, $mathcalE(alpha)^n=mathcalE(nalpha)$. In your example, $n=mathcalE(alpha^-1)$ and thus after decryption you will have $mathcalE(alpha^-1)times alpha$ ans not $alpha^-1 times alpha$. This is a high level answer, but you need to define the modulo $N$ of your system.






      share|improve this answer








      New contributor




      Youssef El Housni is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
      Check out our Code of Conduct.



















        up vote
        1
        down vote










        up vote
        1
        down vote









        Given two plaintexts $alpha$ and $beta$, Pailler cryptosystem $mathcalE$ homomotphic property is: $mathcalE(alpha)times mathcalE(beta)=mathcalE(alpha+beta)$. So, $mathcalE(alpha)^n=mathcalE(nalpha)$. In your example, $n=mathcalE(alpha^-1)$ and thus after decryption you will have $mathcalE(alpha^-1)times alpha$ ans not $alpha^-1 times alpha$. This is a high level answer, but you need to define the modulo $N$ of your system.






        share|improve this answer








        New contributor




        Youssef El Housni is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
        Check out our Code of Conduct.









        Given two plaintexts $alpha$ and $beta$, Pailler cryptosystem $mathcalE$ homomotphic property is: $mathcalE(alpha)times mathcalE(beta)=mathcalE(alpha+beta)$. So, $mathcalE(alpha)^n=mathcalE(nalpha)$. In your example, $n=mathcalE(alpha^-1)$ and thus after decryption you will have $mathcalE(alpha^-1)times alpha$ ans not $alpha^-1 times alpha$. This is a high level answer, but you need to define the modulo $N$ of your system.







        share|improve this answer








        New contributor




        Youssef El Housni is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
        Check out our Code of Conduct.









        share|improve this answer



        share|improve this answer






        New contributor




        Youssef El Housni is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
        Check out our Code of Conduct.









        answered yesterday









        Youssef El Housni

        1545




        1545




        New contributor




        Youssef El Housni is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
        Check out our Code of Conduct.





        New contributor





        Youssef El Housni is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
        Check out our Code of Conduct.






        Youssef El Housni is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
        Check out our Code of Conduct.



























             

            draft saved


            draft discarded















































             


            draft saved


            draft discarded














            StackExchange.ready(
            function ()
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f63991%2fhomomorphic-properties-of-paillier%23new-answer', 'question_page');

            );

            Post as a guest















            Required, but never shown





















































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown

































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown






            Popular posts from this blog

            How to check contact read email or not when send email to Individual?

            Displaying single band from multi-band raster using QGIS

            How many registers does an x86_64 CPU actually have?