Scalable and maliciously secure threshold paillier cryptosystem

Abstract

System and method for executing scalable maliciously secure threshold Paillier cryptosystem. Distributed key generation includes generating Paillier public key N including bi-pnme modulus N=PQ, for large primes P, Q, such that; P = Q = 3 mod. 4; GCD(P --- 1, Q — 1) = 2; and GCD(N,Ø (N)) = 1, and generating Shamir secret sharing over integers of Paillier private key d satisfying; d = 0 modØ(N) and GCD(d, N) = 1. Public key N may be used to encrypt message to produce a ciphertext and / or to apply homomorphic evaluation of a linear function on a group of ciphertexts. Decryption includes generating at least one decryption share ctj = ctdj of a ciphertext (cr) from at least one respective party Pj, where ct is in Z*N2, and. private key d. After collecting a threshold of valid, t out of n generated decryption shares, ciphertext is decrypted to produce a plaintext by performing a reconstruction of the Shamir secret sharing in the exponent.

Description

[0001] SCALABLE AND MALICIOUSLY SECURE THRESHOLD PAILLIER CRYPTOSYSTEM

[0002] CROSS-REFERENCE TO RELATED APPLICATIONS

[0003] This application claims priority to U.S Provisional Application No. 63 / 523,099, filed on 25 June 2023, the entire contents of which are incorporated herein by reference.

[0004] TECHNICAL FIELD

[0005] The present disclosure generally relates to the field of cryptography, and more particularly to public-key encryption schemes.

[0006] BACKGROUND

[0007] The “Paillier encryption scheme” from 1999 has gained significant popularity due to its advantageous properties. The Paillier scheme is a public-key encryption scheme renowned for its additive homomorphic property, enabling linear operations on encrypted data without requiring decryption. Additionally, the Paillier scheme supports a large message space, enabling useful operations on secrets.

[0008] Motivated by applications in voting systems, several authors have proposed threshold variants of the Paillier encryption scheme. These threshold variants are based on similar constructions for RSA (Rivest-Shamir-Adleman) signatures. A threshold encryption scheme facilitates a set of parties utilizing a public encryption key “pk” to encrypt messages while collectively maintaining the corresponding secret key “.'A” for decrypting ciphertexts. In this scheme, each party Pj possesses a secret decryption key share skj. When the parties collectively decide to decrypt a ciphertext ct, they participate in a cryptographic protocol that ultimately reveals the message while ensuring the confidentiality of the secret decryption key. Typically in such protocols, each party Pj broadcasts a “decryption share” If a sufficient number of parties, passing a certain predefined threshold, broadcast their decryption shares, those can then be locally combined by any one to recover the plaintext pt =

[0009] The combination of homomorphic properties and threshold decryption capabilities has rendered the Paillier encryption scheme highly appealing in systems focused on privacypreserving voting and data aggregation in general. Moreover, threshold decryption of the Paillier scheme (and additively homomorphic encryption in general) serves as a foundational building block in other cryptographic protocols like threshold signatures and secure multiparty computation (MPC) in general]. In many prior works, the focus was primarily on the threshold Paillier decryption feature. However, these approaches often relied on a trusted dealer for key generation and secret key share distribution. This reliance reintroduced a security risk that originally prompted the use of threshold encryption in the first place. To this end, fully-fledged threshold schemes have been proposed. In these schemes, the involvement of a trusted dealer is entirely eliminated, and the generation and distribution of keys are carried out by the participating parties themselves.

[0010] Similar to other RSA-based primitives, such as signature and verifiable delay function (VDF) schemes, the public key of the Paillier encryption scheme consists of a modulus N that is the product of two large prime numbers P and Q. Therefore, many works deal with distributed RSA modulus as a standalone and independent building block, leaving additional necessary cryptographic material to be generated by the specific application, such as RSA signature, RSA encryption, VDF, or Paillier encryption schemes. The additional cryptographic material may be different from scheme to scheme. For example, in the threshold RSA signature scheme, P / s signature share on message m is computed by: where d = Σ djis the secret signing key shared among the parties, and the final signature is: If one of the parties computes an incorrect partial signature then it is evident to everyone, since the final signature will not verify. In contrast, in the context of threshold encryption, without employing some verifiability mechanism it might not be possible to tell whether a decryption share was computed correctly or not. To this end, proposals for threshold Paillier devise such a verifiability mechanism, in the form of a zero-knowledge (zk) proof. That is, in addition to the aforementioned decryption share, each party provides a zero-knowledge proof for the claim that the decryption share is computed correctly using its secret key share. In that sense, the proposed threshold Paillier protocols differ mostly in the way that the zero- knowledge proof is implemented, offering a trade-off between efficiency and security. Specifically, these protocols may offer a trade-off in the following three metrics: key generation efficiency, proof efficiency, and strength of assumptions. “Key generation efficiency” refers to whether distributed key generation is practical. “Proof efficiency” refers to the size and the time it takes to generate / verify the zero-knowledge proof of the correctness of the decryption share. “Strength of assumptions” refers to the cryptographic assumptions underlying the soundness of the proof A zero-knowledge proof is a cryptographic method that enables one party (the prover) to prove to another party (the verifier) that a statement is true without revealing any information beyond the validity of the statement itself. This concept ensures that the verifier learns nothing about the statement other than the fact that it is true.

[0011] Considering only protocols with a feasible key generation phase, one must choose between a protocol with an efficient proof system that relies on nonstandard assumptions, and a protocol having a proof system that is inefficient but relies on standard widely accepted assumptions. .Accordingly, there is uncertainty whether it is possible for a threshold Pailher encryption scheme to incorporate an efficient key generation and proof while relying solely on standard assumptions.

[0012] The aforementioned tradeoff involves a tension between efficiency and the level of leniency associated with relying on nonstandard assumptions. One example is a protocol described in Algesheimer et al. (Joy Algesheimer, Jan Camenisch, and Victor Shoup. Efficient computation modulo a shared secret with application to the generation of shared safe-prime products. In Advances in Cryptology-CRYPTO 2002: 22nd Annual International Cryptology Conference Santa Barbara, California, USA, August 18-22, 2002 Proceedings 22, pages 417- 432. Springer, 2002), which allows distributed generation of a bi-prime public key N = PQ consisting of safe primes (i.e., with and —— primes). The fact that N is a product of safe primes enables an efficient zero knowledge protocol for the correctness of the threshold decryption, while also achieving security under standard assumptions. Generating N as a product of safe primes is commonly adopted by works that assume a trusted dealer, since a dealer can easily generate such a key. However, distributed generation of safe primes remains an infeasible task, as is evident by the lack of implementation of the protocol described in Algesheimer et al.

[0013] Another example is disclosed in Damgard and Koprowski (Ivan Damgard and Maciej Koprowski. Practical threshold RSA signatures without a trusted dealer. In Advances in Cryptology- EUROCRYPT 2001: International Conference on the Theory and Ap- plication of Cryptographic Techniques Innsbruck, Austria, May 6-10, 2001 Proceedings 20, pages 152— 165. Springer, 2001), which proposes a protocol for threshold RSA that lowers the bar by generating a public key N that is a product of “general” primes P, Q (i.e., they are not necessarily safe), and using the same efficient zk-proof as described in Fouque et al. (Pierre- Alam Fouque, Guillaume Poupard, and Jacques Stern. Sharing decryption in the context of voting or lotteries. In Financial Cryptography: 4th International Conference, FC 2000 Anguilla, British West Indies, February 20-24, 2000 Proceedings 4, pages 90-104. Springer, 2001).

[0014] This result is transferable to a threshold Paillier scheme, as mentioned in Damgard, Jurik et al. (Ivan Damgard, Mads Jurik, and Jesper Buus Nielsen. A generalization of Paillier’s public-key system with applications to electronic voting. International Journal of Information Security, 9:371-385, 2010). However, since the generated primes may lack some important properties that exist in safe primes, the soundness of that zk proof has to rely on non-standard assumptions.

[0015] In order to bridge the abovementioned cases, a new protocol is proposed by Fouque and Stern (Pierre- Alam Fouque and Jacques Stern. Fully distributed threshold RSA under standard assumptions. In Advances in Cryptology- ASIACRYPT 2001: 7th International Conference on the Theory and Application of Cryptology and Information Security Gold Coast, Australia, December 9-13, 2001 Proceedings 7, pages 310-330. Springer, 2001), in which the key generation produces primes P, Q that are only “almost safe primes”, meaning - are “B-rough numbers” and ''copr-ime ' . Unlike general primes, the β- roughness property facilitates a proof of soundness for the zk-protocol without relying on new' assumptions. Nevertheless, while distributed generation of almost safe primes can be done, it is impractical for most use-cases (for example, generation of almost safe primes may be 1000 times slower than general ones). Moreover, the technique incurs a degradation of the efficiency of the zk proof (e.g., the proof efficiency may be about 30 times worse compared to Damgard and Koprowski).

[0016] Another bridging attempt is described in Hazay et al. (Carmit Hazay, Gert Lsessoe Mikkelsen, Tal Rabin, Tomas Toft, and Angelo Agatino Nicolosi. Efficient RSA key generation and threshold paillier in the two-party setting. Journal of Cryptology, 32:265-323, 2019). This protocol builds on a public key A that is a product of general primes but uses a different zero knowledge protocol (using a “cut-and-choose” technique) than the one used in Damgard and Koprowski. The proof of this protocol, while relying on standard assumptions, suffers from poor soundness (1 / 2), where the proof needs to be repeated K times to meet real security requirements.

[0017] Since safe prime generation as in Algesheimer et al, is infeasible, a choice remains between accepting the extra assumptions in Damgard and Koprowski and obtaining an efficient proof (and therefore threshold decryption), or sticking to the widely accepted assumptions but suffering an inefficient proof, as in Fouque and Stern and Hazay et al.

[0018] A different approach is proposed by Baum et al. (Carsten Baum, Ivan Damgard, Tomas Toft, and Rasmus Zakarias. Better preprocessing for secure multiparty computation. In Applied Cryptography and Network Security: 14th International Conference, ACNS 2016, Guildford, UK, June 19-22, 2016. Proceedings 14, pages 327-345. Springer, 2016), which removes the zk proof from threshold Paillier decryption altogether. That is, in order to decrypt the ciphertext , the parties first reconstruct the randomness r, which in turn enables learning the plaintext m. This approach, however, apart from revealing the randomness r to the adversary, enables an attacker to anonymously cheat in the reconstruction of r and thus to deny decryption. Both of the above issues are problematic m most cases but may be tolerable in some scenarios.

[0019] Previous work by Seres and Burcsi (Istvan Andras Seres and Peter Burcsi. A note on low- order assumptions in RSA groups. Rad Hrvatske akademije znanosti i umjetnosti. Matematicke znanosti, (546=25), 15-31, 2021) upgrades the security assumptions of Pietrzak’s proof of exponentiation. While the reductions share some ideas there are meaningful differences. Most importantly they assume that does not have factors in a certain range, which may be okay in certain contexts since a single party holding the factorization of N can provide a proof of this fact. However, in other contexts it is much more involved to produce such a proof when the factorization of N is shared among the parties.

[0020] SUMMARY

[0021] In accordance with an aspect of the present disclosure, there is provided a method for threshold Paillier distributed key generation. The method includes the step of generating a Paillier public key N including a bi-prime modulus N=PQ, for large primes PjQ, such that: The method includes the step of generating a Shamir secret sharing over integers of a Paillier private key d satisfying: d = and GCD(d, N) ~ 1.

[0022] In some aspects, claim 1, GCD(d, N) = 1 may include d = 1 mod N.

[0023] In some aspects, for each party Pj of a plurality of parties Pj, the method for threshold Paillier distributed key generation may further include the steps of: sampling random bases and publishing a verification key

[0024] In accordance with another aspect of the present discl osure, there is provided a method for threshold Paillier encryption. The method include the step of encrypting a message to produce a ciphertext using a Paillier public key “N” including a bi-prime modulus N=PQ, for large primes / ’, Q, such that:

[0025] In accordance with a further aspect of the present disclosure, there is provided a method for threshold Paillier homomorphic linear evaluation. The method includes the step of applying a homomorphic evaluation of a linear function f on a group of ciphertexts using a Paillier public key “N” comprising a bi-prime modulus N--PQ, for large primes PjQ, such that: P = Q =

[0026] In accordance with a further aspect of the present disclosure, there is provided a method for threshold Paillier decryption. The method includes the step of sending at least one decryption share ctj = ctdi of a ciphertext (ct) from at least one respective party Pj, where ct is in and wherein d is a Paillier private key with Shamir secret sharing over integers of d satisfying: d = The method includes the further step of, after collecting a threshold of t out of n decryption shares, decrypting the ciphertext to produce a plaintext by performing a reconstruction of Shamir secret sharing in exponent.

[0027] In some aspects, sending at least one decryption share may further include sending with the decryption share a zero-knowledge (ZK) proof that ctjis computed correctly using the public ciphertext (ct) and private key share djof party Pj, wherein the ZK proof comprises an equality of discrete logs proof of values ctj and w over QRN2, with respect to the bases ct and g, wherein and wherein is a verification key = gdi, and decrypting the ciphertext may be performed after verifying the ZK proofs of the received decryption shares, and after collecting a threshold of verified t out of n decryption shares.

[0028] In some aspects, sending the decryption shares may be implemented by a first entity, and collecting the decryption shares and decrypting the ciphertext may be implemented by a second entity.

[0029] In some aspects, a single party may prove a plurality of statements to securely run threshold decryption of a plurality of ciphertexts in parallel, using batching.

[0030] In some aspects, the method for threshold Paillier decryption may further include performing batch verification of the ZK proofs, where verifying the ZK proofs includes a single verifier validating a plurality of ZK proofs from different parties, using at least one multi- exponentiati on technique ,

[0031] In some aspects, at least one of the methods may be applied in a decentralized network. The decentralized network may include at least one of: a blockchain system, and a large-scale secret information sharing system.

[0032] In accordance with an aspect of the present disclosure, there is thus provided a system for threshold Paillier distributed key generation. The system includes a processor, configured to receive a request to execute a Paillier distributed key generation. The system includes a key generation module, configured to generate a Paillier public key N by applying a bi-prime modulus N=PQ, for large primes P, Q, such that: 2; and and to generate a Shamir secret sharing over integers of a Paillier private key d satisfying:

[0033] In some aspects, claim may include d = 1 mod N.

[0034] In some aspects, for each party Pjof a plurality of parties Pj, the key generation module may further be configured to: sample random bases g and publish a verification key t g

[0035] In accordance with another aspect of the present disclosure, there is provided a system for threshold Paillier encryption. The system includes a processor, configured to receive a request to execute a Paillier encryption. The system includes an encryption module, configured to encrypt a message to produce a ciphertext using a Paillier public key “TV” including a bi-prime modulus Q, g p Q ( Q ) 2; and

[0036] In accordance with another aspect of the present disclosure, there is provided a system for threshold Pailli er homomorphic linear evaluation. The system includes a processor, configured to receive a request to execute a Paillier homomorphic linear evaluation. The system includes a homomorphic linear evaluation module, configured to apply a homomorphic evaluation of a linear function f on a group of ciphertexts using a Paillier public key “N” comprising a bi-prime modulus N=PQ, for large primes P, Q, such that: P — Q = 3 mod 4; GCD(P — 1, Q — 1) =

[0037] In accordance with a further aspect of the present disclosure, there is provided a system for threshold Paillier decryption. The system includes a processor, configured to receive a request to execute a Paillier decryption. The system includes a decryption share generation module, configured to send at least one decryption share ) of a ciphertext (ct) from at least one respective party Pj, where ct is in and wherein d is a Paillier private key with Shamir secret sharing over integers of d satisfying: d ~ The system includes a decryption share combination and computation module, configured to collect a threshold of valid t out of n generated decry ption shares, and to decrypt the ciphertext to produce a plaintext by performing a reconstruction of Shamir secret sharing in exponent.

[0038] In some aspects, the decryption share generation module may further be configured to send with the decryption share a zero-knowledge (ZK) proof that ct, is computed correctly using the public ciphertext ct and private key share dj of party Pj, wherein the ZK proof comprises an equality of discrete logs proof of values ctj and v< over QRN2, with respect to the bases ct and g, wherein and where vj is a verification key and the decryption share combination and computation module may be configured to decrypt the ciphertext after verifying the ZK proofs of the received decryption shares, and after collecting a threshold of verified t out of n decryption shares.

[0039] In some aspects, the decryption share generation module s may be implemented by a first entity, and the decryption share combination and computation module may be implemented by a second entity.

[0040] In some aspects, a singl e party may prove a plurality of statements to securely run threshold decryption of a plurality of ciphertexts in parallel, using batching.

[0041] In some aspects, the system for threshold Paillier decryption may further include a party configured to perform batch verification of the ZK proofs, where verifying the ZK proofs includes a single verifier validating a plurality of ZK proofs from different parties, using at least one multi-exponentiation technique.

[0042] In some aspects, at least one of the systems may include a decentralized network that performs one or more operations. The decentralized network may include at least one of: a blockchain system, and a large-scale secret information sharing system. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The present disclosure will be understood and appreciated more fully from the following detailed description taken in conjunction with the drawings in which:

[0044] Figure 1 is a schematic illustration of a system for executing a scalable maliciously secure threshold Paillier cryptosystem, constructed and operative in accordance with an embodiment of the present disclosure;

[0045] Figure 2 is a schematic illustration of information flow in a scalable maliciously secure threshold Paillier cryptosystem, operative in accordance with an embodiment of the present disclosure;

[0046] Figure 3 is a schematic illustration of the distributed key generation module of Figures 1 and 2, operative in accordance with an embodiment of the present disclosure;

[0047] Figure 4 is a schematic illustration of the decryption shares generation module of Figures 1 and 2, operative in accordance with an embodiment of the present disclosure,

[0048] Figure 5 is a schematic illustration of the decryption shares combination module of Figures 1 and 2, operative in accordance with an embodiment of the present disclosure;

[0049] Figure 6 illustrates a pair of graphs depicting the time to generate a decryption share with and without proof of equality of discrete logs, as measured in performance evaluations implemented on two types of machines, operative in accordance with an embodiment of the present disclosure; and

[0050] Figure 7 illustrates a pair of graphs depicting the time to combine decryption shares from parties of B ciphertexts, with and without proof of equality of discrete logs, as measured in performance evaluations implemented on two types of machines, operative in accordance with an embodiment of the present disclosure.

[0051]

[0052] The present invention may overcome the disadvantages of the prior art by providing a novel approach for a scalable maliciously secure threshold Paillier cryptosystem. The disclosed embodiments relate to a threshold Paillier cryptosystem scheme that incorporates an efficient key generation and proof while relying solely on standard assumptions (i.e., only decisional composite residuosity (DCR) assumptions required for semantic security of Paillier encryption). The present disclosure departs from protocols having an efficient key generation and proof but relies on nonstandard assumptions, and presents a novel reduction technique (i.e., if one problem is solvable then it can be “reduced” to solve a different problem) that is applied to the proof of soundness of the zero-knowledge proof of a correct decryption share (where each party computes its own decryption “share”). The disclosed embodiments may allow for novel use of an efficient version (i.e., efficient comparable to an “ideal scheme” where it is assumed that all parties are honest) of threshold Paillier without compromising on security.

[0053] The term “scalable threshold Paillier cryptosystem (STPC)” scheme is used herein to refer to a cryptosystem scheme in accordance with one or more aspects or embodiments of the present disclosure.

[0054] The disclosed STPC scheme is directed to a practical, efficient, large-scale threshold Paillier cryptosystem scheme, supporting efficient distributed key generation and threshold decryption, built upon the same decisional composite residuosity assumption as the standard (i.e., non-threshold) Paillier encryption. The protocol is secure in the presence of a malicious adversary who controls up to t < n parties.

[0055] According to embodiments, one aspect of the STPC scheme is a novel proof for the soundness of the standard proof system of equality of discrete logs over the group QRN2 of quadratic residues modulo N2, even when N is not a product of safe primes. Such proof maybe of further interest independent to the disclosed threshold Paillier cryptosystem. Firstly, the same proof may be used in threshold protocols over RSA groups, such as for a threshold RSA signature. Secondly, the requirement of safe primes in various cryptographic primitives may be reassessed. The ramification of the proof is that distributed Paillier key generation may be implemented using any distributed bi-prime modulus generation (for “general” primes), and in particular, recent advances may be leveraged to enable key generation by thousands of parties.

[0056] In a real-world system required to continuously process many ciphertexts, the parties need to verify decryption shares received from other parties for each of these ciphertexts. Verification of decryption shares from many parties across multiple ciphertexts can easily dominate the overall cost of decryption. To address this issue, a batching technique may be used that allows a prover to batch several decryption shares into a single proof. Specifically, proving and verifying B statements using the batched proof system uses a single “large” exponentiation and 0(B) “small” exponentiations, rather than 0(B) large exponentiations (where “large” refers to the size of the shares, e.g., 4096 bits, and “small” refers to the computational security parameter, e.g., 128 bits). The original proof of this batching technique has also assumed safe primes. A prime number P is considered a safe prime if it can be expressed in the form P = 2Q + 1, where Q is also a prime number.

[0057] The present disclosure includes a novel proof which may avoid this issue, resulting in a batched proof system for threshold Paillier decryption when N is not a product of safe primes. Overall, a significantly more efficient proof system is introduced for the equality of discrete logs. Consequently, the total time complexity of threshold decryption may be reduced to roughly that of a semi-honest model with no proof system (e.g., for 1000 parties the proof overhead may be about 5%). A semi-honest model is a concept in cryptographic protocols and secure multi-party computation (SMPC) that assumes that all parties involved follow the protocol correctly, but they are curious and will try to learn as much information as possible from the data they receive during the protocol execution.

[0058] Table 1 shows a comparison of the performance of the disclosed STPC scheme with previous schemes that rely only on standard assumptions. Specifically, Table 1 depicts the number of exponentiations required for proof generation and verification in each protocol, when “K” represents computational security (i.e., 2Kis infeasible), and “a” represents statistical security (i.e., 2‘cis negligible). For Fouque and Stern, a guaranteed B-roughness of is utilized.

[0059] Table 1:

[0060] As the performance is dominated by exponentiations by a large exponent (e.g., a bit length of thousands), Table 1 focuses on that metric. Note that the large exponents in all the protocols are of the same size. Importantly, the STPC protocol is the only one that supports batch decryption (which essentially requires aggregation of proofs). Thus, in Fouque and Stern and Hazay et al., the overhead of decrypting a batch of ciphertexts grows linearly with the batch size, whereas in the STPC protocol the overhead remains constant.

[0061] Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. It will be further understood that terms, such as those defined in commonly used dictionaries, should be interpreted as having a meaning that is consistent with their meaning in the context of the specification and claims and should not be interpreted in an idealized or overly formal sense unless expressly so defined herein. Well-known functions or constructions may not be described in detail for brevity and / or clarity.

[0062] It will be understood that, although the terms first, second, etc., may be used herein to describe various elements, components, regions, layers and / or sections, these elements, components, regions, layers and / or sections should not be limited by these terms. Rather, these terms are only used to distinguish one element, component, region, layer and / or section, from another element, component, region, layer and / or section.

[0063] It will be understood that when an element is referred to as being “on”, “attached” to, “operatively coupled” to, “operatively linked” to, “operatively engaged” with, “connected” to, “coupled” with, “contacting”, “added to, another element, it can be directly on, attached to, connected to, operatively coupled to, operatively engaged with, coupled with, added to, and / or contacting the other element or intervening elements can also be present. In contrast, when an element is referred to as being “directly contacting” another element or “directly added” to another element, there are no intervening elements and / or steps present.

[0064] Whenever the term “about” or “approximately” is used, it is meant to refer to a measurable value such as an amount, a temporal duration, and the like, and is meant to encompass variations (e.g., ±20%, ±10%, ±5%, ±1%, ±0.1 %) from the specified value, as such variations are appropriate to perform the disclosed methods.

[0065] Certain features of the invention, which are, for clarity, described in the context of separate embodiments, may also be provided in combination in a single embodiment. Conversely, various features of the invention, which are, for brevity, described in the context of a single embodiment, may also be provided separately or in any suitable sub-combination or as suitable in any other described embodiment of the invention. Certain features described in the context of various embodiments are not to be considered essential features of those embodiments, unless the embodiment is inoperative without those elements.

[0066] Whenever terms “plurality” and “a plurality” are used it is meant to include, for example, “multiple” or “two or more”. The terms “plurality” or “a plurality” may be used throughout the specification to describe two or more components, devices, elements, units, parameters, or the like. The term set when used herein may include one or more items. Unless explicitly stated, the method embodiments described herein are not constrained to a particular order or sequence. Additionally, some of the described method embodiments or elements thereof can occur or be performed simultaneously, at the same point in time, or concurrently.

[0067] Throughout, this disclosure mentions “disclosed embodiments”, “disclosed systems” and “disclosed methods”, which refer to examples of inventive ideas, concepts, and / or manifestations described herein. The fact that some disclosed embodiments are described as exhibiting a feature or characteristic does not mean that other disclosed embodiments necessarily share that feature or characteristic.

[0068] This disclosure employs open-ended permissive language, indicating for example, that some embodiments “may” employ, involve, or include specific features. The use of the term “may” and other open-ended terminology is intended to indicate that although not every embodiment may employ the specific disclosed feature, at least one embodiment employs the specific disclosed feature.

[0069] The terms “user” and “operator” are used interchangeably herein to refer to any individual person or group of persons using or operating a method or system of a disclosed embodiment.

[0070] Reference is made to Figure 1, which is a schematic illustration of a system, generally referenced 100, for executing a scalable maliciously secure threshold Paillier cryptosystem, constructed and operative in accordance with an embodiment of the present disclosure. System 100 may be implemented in several ways, such as for example as an integrated circuit, and / or an embedded software, application, module, process or subsystem of a computer, and may be used as part of one or more tools or activities over the Internet. In the example of Figure 1, system 100 is embodied by an integrated circuit (IC) or system on chip 110 of a computing device, such as a smartphone, a laptop computer, a mobile computer, a tablet computer, a wearable computer, or any type of electronic device with computing and processing capabilities. It should be noted, however, that the present invention is not limited to the described embodiments and can be used in any system where data encryption is desired.

[0071] SOC 110 includes on-chip components, including a processor 112, a memory 114, a group of Paillier cryptosystem modules 116, and a communication interface 118, which are interconnected or communicatively coupled via a bus 120. Processor 112 performs data processing and may receive instructions or information from other components of SOC 110 or system 100. Memory 114 is configured for data storage. Paillier cryptosystem modules 116 is configured to execute cryptography operations, such as by applying one or more mathematical operations, equations and / or processes on variables or input data, which may result in corresponding output data. Such cryptography operations may include, but are not limited to, encryption, decryption, key generation, and digital signature operations. Paillier cryptosystem modules 116 includes a distributed key generation (DKG) module 150, an encryption module 160, a decryption share generation module 170, a decryption share combination and computation module 180, and a homomorphic linear evaluation (HLE) module 190. Processing associated with Pailtier cryptosystem modules 116 may be implemented at least in part using processor 112. It is noted that the present invention may be implemented as a stand-alone Paillier cryptosystem module 1 16 but is described in Figure 1 as part of an SOC 1 10 of system 100. Each of the individual modules (150, 160, 170, 180, 190) of Paillier cryptosystem modules group 116 may be independent, where SOC 100 may include only one or more of modules 150, 160, 170, 180, 190. For example, different modules (150, 160, 170, 180, 190) may be associated with different parties or entities, each of which may be responsible for a respective stage of the cryptosystem (i.e., responsible for implementing different cryptography operations). Communication interface 118 may transmit information to and / or receive information from an external source, such as one or more data networks, using any suitable communication channel or network model and data transmission protocol. Information may be conveyed between the components of SOC 110 over bus 120.

[0072] The components and devices of system 100 may be based in hardware, software, or combinations thereof. It is appreciated that the functionality associated with each of the devices or components of system 100 may be distributed among multiple devices or components, which may reside at a single location or at multiple locations. For example, the functionality associated with processor 112 may be distributed between a single processing unit or multiple processing units, including different types of processing units. Furthermore, at least part of the functionality associated with system 100 may reside externally to SOC 110. For example, the functionality of Paillier cryptosy stem modules group 116 may operate at least partially on SOC 110 (e.g., using processor 112) and at least partially on a server or remote computer system accessible over a communications network, such as a cloud computing server. System 100 may optionally include and / or be associated with additional components or modules not shown in Figure 1 , for enabling the implementation of the disclosed subject matter.

[0073] Reference is made to Figure 2, which is a schematic illustration of information flow in a scalable maliciously secure threshold Paillier cryptosystem, operative in accordance with an embodiment of the present disclosure. The illustrated information flow may be implemented at least in part by elements associated with Paillier cryptosystem modules 116 of system 100, instances of which may execute on one or more separate devices. Distributed key generation module 150 generates a Paillier public key ( / V) 153 and a plurality of Paillier private key shares (dj) 157, using key generation processes that will be elaborated upon hereinbelow. For example, referring to Figure 3, DKG module 150 generates multiple key shares (d1, d2, d3, dn), referenced 157A, 157B, 157C, 157D, by respective DKG parties 155 A, 155B, 155C, 155D. An encryption module 160 encrypts an input dataset or message (m) using the generated public key 153 to produce a ciphertext 163 which may be stored in a secure encrypted database 145 (e.g., at a secured server). Optionally, HLE module 190 may apply a linear evaluation function to the ciphertext 163 using a linear evaluation function f(x) 192 as input and generates a second ciphertext 165 Decryption share generator module 170 generates a plurality of decryption shares 167 of respective parties, using decryption share generation processes that will be elaborated upon hereinbelow. For example, referring to Figure 4, decryption share generation module 170 generates multiple decryption shares , referenced 167A, 167B, 167C, 167D, by respective decryption parties 175A, 175B, 175C, 175D, using a ciphertext 163 (or linear evaluation ciphertext 165) and key shares 157.A, 157B, 157C, 157D as input. Decryption share combination and computation module 180 receives and combines the decryption shares 167 and performs a decryption computation to produce a final plaintext which is a function of the original message (pt ~ For example, referring to Figure 5, decryption share combination module 180 combines multiple decryption shares 167 A, 167B, 167C, 167D generated by respective decryption parties 175 A, 175B, 175C, 175D, and using public key 153 performs a decryption operation on the decryption shares 167 using public key 153 to produce a plaintext 185.

[0074] DKG module 150, encryption module 160, decryption share generation module 170, decryption share combination and computation module 180, HLE module 190, and database 145 may be communicatively coupled through at least one communication network 195, and may be executed by one or more distinct devices or components, each of which may reside at a respective location. Accordingly, information may be conveyed between modules 150, 160, 170, 180, 190 and database 145 over network 195 as well as to / from other networks communicatively coupled thereto, via any suitable data communication channel or network, using any suitable channel or network model and any suitable data transmission protocol, such as via a secured communication protocol. For example, message 161 may be uploaded and encrypted by encryption module 160 executing in a cloud server using a cloud computing platform.

[0075] The operation of Paillier cryptosystem module 1 16 will now' be described in general terms, followed by specific examples. To begin with, a high-level overview of the threshold Paillier decryption is presented hereinbelow. A Paillier public key is a modulus N that is a product of two large primes P and Q. In cryptography, a large prime number is a prime number that is large enough to provide a significant level of security. Prime numbers may be considered large, for example, if they are hundreds or thousands of bits in length. In one embodiment, a large prime number is at least a 1024-bit prime number. In one embodiment, a large prime number is at least a 2048-bit prime number. The secret key (Paillier private key) d is derived from these primes, and it is assumed to be practically impossible to obtain it from N. In threshold Paillier key generation protocols, the parties first obtain a sharing of P and , and then derive a sharing of d as the product N:::PQ in plain (i. e. , unencrypted) form. To be more specific, the generated primes P and Q are required to satisfy g (0( ) ) 0( ) )(Q ) Using this fact, a secret key is computed by d ~ mod and shared among the parties using a Shamir secret sharing scheme over the integers, such that Pj obtains a share dj.

[0076] A Shamir secret sharing scheme is a cryptographic algorithm that divides a secret into multiple parts, called shares, so that the secret can only be reconstructed when a sufficient number of shares are combined together. A Shamir secret sharing scheme is based on polynomial interpolation. In a Shamir secret sharing scheme, a secret is represented as the constant term of a polynomial and points on this polynomial are distributed as shares. The secret may be treated as a number S. A random polynomial of degree k-1 is created according to the function: where S is the secret, and ai, a2, ... , are randomly chosen coefficients. Share generation may be performed by evaluating the polynomial at n different non-zero points to create shares, wherein , and each participant may receive one pair

[0077] In a Shamir secret sharing scheme, to reconstruct the secret, any k shares can be used. Using these shares, the polynomial can be interpolated to find the constant term S, such as by Lagrange interpolation. The secret S is the constant term of the polynomial, which is f(0).

[0078] There may be several choices for the exact form of the secret key but they are generally all variants of the one described. Some existing schemes assume secret sharing over the ring but this may be harder to achieve without a trusted dealer. In addition to the public modulus N, the parties generate a public verification key v, for every’ Pj, such that Vj = g for some basis element g from the group of quadratic residues modulo , when the parties agree to decrypt a ciphertext ct, party Pj sends the decryption share ctj = ctdi along with a zero-knowledge proof that ctj is computed correctly using the public ct and the secret dj (when the threshold is smaller than the number of parties each exponent may be multiplied by the appropriate Lagrange coefficient). This proof is a proof of “equality of discrete logs” of the values with respect to the bases ct and g. That is, if Pi computes its decryption share correctly then l dj.

[0079] The following presents in greater detail the reasons that safe primes may be powerful for efficient proofs. Subsequently it will be described how a similar efficiency may be achieved without using safe primes and without resorting to additional assumptions. Suppose that the generated modulus N is a product of two safe primes P,Q, meaning that are primes as well. There may be three mam benefits from the assumption that P' and Q' are primes:

[0080] 1. In the context of proofs for equality of discrete logs, it is commonly assumed that the group is cyclic. For any pair P, Q of distinct safe primes, the group is guaranteed to be cyclic, since and the orders of and QRQ2 are co-prime. However, in the general case these orders may share a common factor and the group QRN2 may not be cyclic.

[0081] 2. When the group happens to be cyclic, is guaranteed to have a generator g, meaning that every element in equals gifor some i.

[0082] In fact, the probability of a random element Nto not be a generator, is close to the probability’ of guessing one of the factors of N. Having a generator helps when arguing security for zero knowledge protocols. However, in the general case (where the primes are not safe), even when is cyclic, the probability of a random element to be a generator is not negligible. This problem may be exacerbated by the apparent lack of existing algorithms for finding a generator or determining if an element is a generator.

[0083] 3. A standard proof of soundness obtains an equation of the form for a small e and concludes that x = 1 since e is necessarily co-prime This conclusion cannot be made when P!and Q' are allowed to be composite numbers.

[0084] These three benefits of safe primes are also drawbacks of general primes. Some existing protocols overcome these drawbacks by applying a suitable zero knowledge proof, but do not assume that the primes are safe and therefore rely on a couple of extra assumptions. The first assumption is that it is computationally hard (i.e., not solvable by a probabilistic Turing machine) to compute an element and the order of a is not divisible by the largest factor of 0(iV). The second assumption is that a random element in QRnis indistinguishable from those elements in QRN with maximal order.

[0085] Existing protocols which aim to avoid extra assumptions without requiring the primes to be safe, may be characterized by a degraded efficiency for two reasons. First, the protocol would have to be repeated with many bases g1g2, hich together generate QRN2 with overwhelming probability. Second, the protocol requires to be B-rough (i.e., to have all prime factors larger thanB ), and the soundness depends on B. Since known practical key generation protocols generally result in quite a small B, soundness must be amplified via parallel repetitions. The disclosed STPC scheme relates to a similar approach as existing Paillier cryptosystems but removes extra assumptions commonly used by Paillier cryptosystems, specifically in obtaining an efficient zero knowledge proof of equality of discrete logs over QRN2, even when N is a product of general primes. In other words, the disclosed STPC protocol does not require N to meet one extra constraint, which may only slightly affect the efficiency of the key generation protocol, but not the efficiency of the threshold decryption, and does not require additional cryptographic assumptions. By setting minimal and practically achievable properties to the primes (discussed hereinbelow), the three drawbacks discussed hereinabove may be overcome, such as based on the following observations:

[0086] 1. Even though P, Q are not safe-primes, with high but not overwhelming probability (e.g., 66%), and are co-primes, and therefore QRN2 is a cyclic group of order

[0087] During the key generation protocol the parties will reject prime candidates that do not meet the requirement that and are co-prime. The rejection of prime candidates that do not satisfy that condition incurs only a small constant factor overhead (about 1.5x) to the key generation protocol.

[0088] 2. Even when P,Q are not safe primes, the order of a random element g ∈ QRN2 may be considered “close enough” to the order of QRN2, and so for the present context can be used as if it was a generator. Specifically, it may be proven that with overwhelming probability, the order of a randomly sampled g ∈ QRN2 is at least the order of QRN?. divided by a sufficiently small smooth number δ (i.e., whose prime factors are all smaller than 5).

[0089] 3. For similar reasons, in the proof of soundness, instead of obtaining the equation xe= 1 mod N2we obtain xe 1 mod N2where g E QRN2 has a smooth order 8. This means that xe‘s= 1 mod N2. Then, the proof may be divided into two cases: a) if xe= 1 (as in the case where g is a generator), then the factorization of e can be found since e is small, from which the factorization of N can be found using classical techniques, as long as x 1; b) otherwise, xe=# 1. mod N2is an element of small smooth order and so Pollard’s p - I method may be employed in order to factor N.

[0090] It is noted that the aforementioned ideas may result in an efficient reduction, albeit non-polynomial, and thus may only break the sub-exponential factoring problem. Simulations may be carefully selected such that the size of e has a bound dependent on the chance of success of the PPT adversary rather than directly on the security parameter, resolving this issue. There is also a dependence on the smoothness of the order of .w in the statistical security parameters which may be reduced to a constant by using multiple bases. In view of concrete security, further issues may be considered. For example, the present disclosure provides two reductions, one for the uniform factoring problem and another for the non-uniform factoring problem. Although non-umformity may not be required to prove that the STPC scheme is secure asymptotically, when fixing concrete parameters, the reduction against a non-uniform PPT adversary may be tighter. Specifically, an adversary that breaks the STPC scheme in time 1 ' (K) with probability is reduced to a non-uniform adversar dl that breaks the factoring game above in time ith probability such that ction is linear in On the other hand, the reduction against poly(k) . While this reduction is still polynomial, when fixing concrete parameters, the computational security parameter has to be doubled. Due to the subexponential hardness of factoring, this in turn requires increasing the modulus size by 8x, and so exponentiation will cost at least 64 x more. Another subtle issue arises when applying the Fiat-Shamir transform to the batched proof, which is a 5 round protocol. Generically this may cause significant loss of soundness which would degrade the parameters of the scheme. It can be shown that this is not the case for the batched protocol. The reduction is analyzed such that one may estimate concrete statistical and computational security based on different parameters of the STPC scheme.

[0091] The following presents in greater detail notations and mathematical background relevant to the disclosed embodiments.

[0092] General notation: Let N, Z, Zmdenote the set of natural numbers excluding 0, integers, and integers modulo m, respectively. In addition, denoted by is the multiplicative group modulo in. Denoted by primes and primesmis the set of all prime numbers and the set of prime numbers smaller than m, respectively. Fo and (a, b) denote the sets and respectively. The bit representation of an integer x is denoted (xt-i,..., xo) witlixi-i being the most significant bit denotes a uniform sampling from a set £1 The variables K and σ is used to denote computational and statistical security parameters, respectively. The variable denotes a preliminary statistical security parameter which is upgrade to a. The function denotes the run time of an algorithm

[0093] A on inputs (x1;x2, " " )• A vector of group elements is denoted by where

[0094] Mathematical background: Let for some q then r ~ [a mod b] represents the reduction of a modulo b. If r = 0 then it can be said that “b divides and is denote by b\a. If, in addition then it can be said that “b is a non- trivial factor of α''The formulation mod b is provided if (aimod b) = for all i, j. The values gcd(a, b") and lcm(a, b~) are the greatest common divisor and least common multiple of α and b, respectively. If gcd(a, b) ~ 1 then it is said that “a and b are co-prime”.

[0095] The following presents basic number theoretic properties:

[0096] Proposition A.1: Let

[0097] Proposition A.2: Let Then:

[0098] - Euclidean algorithm- gcd(m, x) ~

[0099] - gcd(m, xr) = 1, if and only if gcd(m, x) = 1, and gcd(m, r) = 1.

[0100] Proposition A.3

[0101] Then, gcd

[0102] Corollary A.4: Let primes: gcd(a, pf) ~ 1 for all i if and only if J = 1.

[0103] Classical number theoretic notions are used herein.

[0104] The following presents three useful definitions:

[0105] Definition 2.1 (β- Smooth Number): For f E N, an integer k is called β-smooth if all the prime factors ofk are smaller than f.

[0106] Definition 2.2 (Safe Prime): A prime number p is called safe if is prime.

[0107] Definition 2.3 (Conforming Bi-Prime): An in teger N is a conforming bi -prime if there exist such that N=PQ, P — Q — 3mod4, = 1, and gcd(

[0108] Groups. Multiplicative notation is used for groups. Let Q be a finite abelian group. For denoted by is the subgroup generated by That is, iW' = and is the order of (number of elements in) and (g), respectively.

[0109] An element is a “quadratic reddue " if there exists an = y. For abelian groups, the set of quadratic residues forms a subgroup. For an integer m > 2, denoted by QRmis the subgroup of quadratic residues in By Lagrange’s theorem, if f is a group and divides |G|.

[0110] Definition 2.4 (Statistical Distance): Let X, Y be two random variables. The statistical distance between X, Y, SD(X, Y) is defined as:

[0111] Hardness assumptions. Let GenModulus be a polynomial time algorithm that, on input IK, outputs (N, P, Q) where IV = PQ, and N is a conforming bi-prime except with probability negligible in K.

[0112] Definition 2.5 (DCR): It is said that the decisional composite residuosity (DCR) problem is hard relative to GenModulus iffor all probabilistic polynomial time algorithms A. there exists a negligible function neg such that: here the probabilities are taken over N as an output from GenModulus( 1K) and

[0113] Definition 2.6 (Factoring): It is said that factoring is hard relative to GenModulus if for all (uniform / non-uniform) probabilistic polynomial time algorithms A there exists a negligible function neg such that the classic factoring problem, GenModulus is defined by choosing P, Q as independently, uniformly random random primes. In the case of distributed key generation, a different GenModulus may be obtained. A reduction between the two cases may be provided.

[0114] The following presents the Shamir threshold secret sharing (“Shamir Secret Sharing”) over a field.

[0115] Shami secret sharing over the field F (where is defined by a tuple of algorithms = (Share, Reconstruct), where denotes a sharing of s using randomness r, and s = denotes the reconstruction using t + 1 shares, which may result with 1 if the shares are inconsistent. For convenience, we assume [s]i also specifies the index itself. With more details:

[0116] - distinct elements from [n]. Let p be the unique interpolation polynomial such that T. Output s = p(0).

[0117] For any subset 7’ of size and every evaluation point v G F, the Lagrange coefficient is defined as Consequently, it can be formulated that: p(v) =

[0118] Local operations over sharings. Given two polynomials P1(x) and p2(x) with secrets s1= P1(0) and secrets s2~ p2(0)> the secret sharing of s = + s2can be locally computed by having each party Pjcompute so that the secret s is shared using the polynomia In addition, given a polynomial p(x) and a (public) constant , the secret sharing of a ■ s can be locally computed by having each party P;compute Similarly, the above may be extended to any affine operation over the secrets.

[0119] The following presents an extension of the Shamir Secret Sharing to over the integers.

[0120] Shamir sharing over the integers

[0121] Shamir t-out-of-n secret sharing over the field F (where t < n G N) is defined by a tuple of algorithms SSF= (Share, Reconstruct'), where [s] = ([s] , [s]n) = Sharet n(s; r) denotes a sharing of s using randomness r, and s denotes the reconstruction using t + 1 shares, which may result with if the shares are inconsistent. With more details:

[0122] *

[0123] ® s = Let be a set of t + 1 distinct elements from [n]. Let p be the unique interpolation polynomial such that p(j) ~ [s ] j for all Lagrange interpolation is used in order to get p(j) directly. For a set ] of t + 1 distinct elements, given points {( / , [s] i)^. , the polynomial that passes through them is

[0124] For any subset 7’ of size t + 1, every j G T and every evaluation point v E F, the Lagrange coefficient is defined as Consequently, one can write: p(v) =

[0125] Given two polynomials with secrets secret sharing of can be locally computed by hav ing each party Pj compute so that the secret s is shared using the polynomial In addition, given a polynomial p(x) and a (public) constan e secret sharing of a - s can be locally computed by having each party Similarly, the above may be extended to any affine operation over the secrets.

[0126] Shamir sharing in the exponent.

[0127] For a finite cyclic group written in multiplicative notation, with a generator g and order q, the sharing of in the exponent is denoted by that is, for a sharing [sj = th e share of is hidden, e.g., for one can use Shamir sharing over the integers.

[0128] Let and define some bound I (a, n, b) on the (absolute value of the) coefficients of the polynomial. Until recently, the bound was used. However, a tighter bound for 7(tr, n, b) may be provided.

[0129] The algorithm Sharers) picks and outputs

[0130] Reconstruction works as follows. Given a set distinct elements, and given points ( ) then where A^j is the Lagrange coefficient corresponding to the point to restore the polynomial p evaluation at v. However, since the Lagrange coefficients might not be in they are first multiplied by A?, to produce: (Equation 1)

[0131] For an (n, t)-threshoki Shamir sharing over the integers of secre the upper bound on the absolute value of the shares on s is denoted by which is:

[0132] If the set T c n is known in advance, reconstruction can tak as input and reconstruction consists of summing all those shares and dividing by For reconstruction in the exponent, that would mean obtaining and multiplying them ah to obtain

[0133] A zero-knowledge protocol between a prover P and a Verifier V is a protocol in which the prover convinces the verifier of some fact regarding a public instance without revealing any information to the verifier beyond the correctness of this fact. A formulation of such property is typically done via three definitions, namely “completeness”, “soundness” and “zero-knowledge”. Completeness means that if both the pro ver and the verifier act according to the protocol then the verifier will accept. Soundness means that it is computationally infeasible for a cheating prover to convince an honest verifier of a false fact. Zero-knowledge means that the verifier does not learn any new information about the instance except the fact. In the present context, a concept known as “Special honest verifier zero-knowledge (SHVZK)” is of particular interest and will be defined hereinbelow.

[0134] Let R c {0,1}* x {0,1}* be a binary relation, where implies The variable w is referred to as a witness for instance x. The variable is defined to be the set of inputs x for which there exists a w such that (x, w) ∈ R.

[0135] Definition 2,7: A protocol it between a prover P and a Verifier V is a zero-knowledge argument of relation R if it satisfies the following:

[0136] - Completeness. If P and V follow the protocol on input x and private input w to P, where (x, w) E R then V always accepts.

[0137] - Soundness. For any stateful polynomial time prover and P2 have an access to the same state)

[0138] While the standard definition of soundness requires the above to hold for every x, here it is required that it holds only for instances x that are output by the dishonest prover P* itself, hinting to the difficulty of finding an instance x for which the equation does not hold.

[0139] - Special honest verifier zero-knowledge. There exists a PPT simulator S' such that for every the view of the verifier is statistically indistinguishable from S(x; z).

[0140] It is common to turn a zero-knowledge protocol into a non-interactive zero-knowledge protocol using the Fiat-Shamir transform for which it is sufficient to consider only an honest verifier.

[0141] Secure Key Generation for Threshold Paillier The following presents a Paillier encryption scheme, which is characterized by the following tuple of algorithms: Paillier ~ (Gen, Enc, Eval, Dec).

[0142] • Gen(1K). Given a security parameter 1K, sample )-bit primes P, Q such that GCD = 1. The algorithm outputs the public encryption key N = P Q and the secret decryption key (N; d) where d = and d ~ 1 mod N ,

[0143] ® Enc(N, pt; r). Given the public key N, a plaintext and randomness , output ciphertext:

[0144] ® Eval(N, Given the public key N, a tuple of ciphertexts and a secret linear function / (%) ~ and r outputs a ciphertext:

[0145] As for homomorphic evaluation:

[0146] ® Dec( (N, d), ct). Given the secret key d and a ciphertext ct, output:

[0147] Correctness. Decryption is always correct because: where equalities (top to bottom) hold by replacing ct with the definition of encryption; the binomial expansion and the fact that (since Proposition A,1 ; and the fact that d = 1 mod N and that pt < N.

[0148] The following presents a standard approach for threshold decryption of Paillier ciphertexts. For simplicity it is assumed that the key generation is done by a trusted dealer. Considering a trusted dealer who runs (N; d) Then the dealer publishes N and shares d over the integers to n parties using a (t. n)-sharing scheme, resulting with [d] such that Pj receives d;. The sharing of d is over rather than over as the parties cannot compute the Lagrange coefficients over because the order | is unknown.

[0149] In the foilowing it is assumed that the parties behave honestly and later will describe how to handle malicious behavior. Given a ciphertext ct party Pj broadcasts its decryption share ;(recall that An= n\). Given ;1, decrypt by computing: where the first equality holds since the third follows by Lagrange interpolation in the exponent, since by Equation 1, and the last one follows by encryption definition.

[0150] Then the plaintext is obtained by computing: as the first equality is derived from the correctness of the Paillier scheme.

[0151] To detect a malicious party Pj- that sends an incorrect decryption share ct,, Pj is required to send a ZK-proof thatctj is computed correctly using the public base ct and the secret share dj. One approach is to use a single verification key. Particularly, in addition to the sharing [dj, the trusted dealer computes and publishes g and v,- — for every P,-, where g is a random element in QRN2. Then, whenever Pj wishes to send its decryption share ct, it also sends a proof that the discrete log of ct, m the basis ct2equals the discrete log of Vj in the basis g. In that sense, Vj is a commitment to the secret share d;- of Pj.

[0152] It is noted that the discrete logarithm equality described above does not assure that Pj behaves honestly, and a slightly stronger claim may need to be proved, as elaborate upon further hereinbelow.

[0153] The following presents a construction for a threshold Paillier cryptosystem with a trustless setup. Subsequently, a protocol to realize an ideal threshold Paillier Functionality is described. The threshold decryption part remains unchanged from the case of a trusted dealer. The keygeneration part of the protocol may be a composition of two steps. The first step is an RS A DC-secure key -generation based on Chen et al. (Megan Chen, Carniit Hazay, Yuval Ishai, Yuriy Kashnikov, Daniele Micciancio, Tank Riviere, Abhi Shelat, Muthu Venkitasubramaniam, and Ruihan Wang. Diogenes: Lightweight scalable RSA modulus generation with a dishonest majority. In 2021 IEEE Symposium on Security and Privacy (SP), pages 590-607. IEEE, 2021). The second step is a UC-secure protocol by Hazay et al. (Carmit Hazay, Gert Mikkelsen, Tai Rabin, Tomas Toft, and Angelo Agatino Nicolosi. Efficient RSA key generation and threshold paillier in the two-party setting. Journal of Cryptology, 32:265-323, 2019) to generate the verification keys that are used in the disclosed Paillier decryption protocol. Hazay et al. first generates a non-standard verification key, namely an “El-Ganial encryption” of the key share. Nevertheless, Hazay et al. provides a zk proof in that ties this verification key with a traditional one that may be used in the disclosed STPC scheme. Importantly, the zk proof in Hazay et al. is also a proof of knowledge, which may be crucial as security proofs of the disclosed STPC scheme may require extraction of secret key shares of the adversary. Also, this proof does not rely on N being composed of safe-primes. Hence, proving validity of decryption shares with respect to traditional verification keys remains a core issue that is addressed further hereinbelow.

[0154] A short summary' of the ideals used for key generation is now' provided. Many protocols for distributed generation of bi-prime (or RSA) modulus have been proposed. In Chen et al., the parties obtain a bi-prime A = PQ for some large primes P and Q, but in the context of the disclosed STPC scheme N needs to be a conforming bi-prime (Definition 2.3). Namely, N ~ PQ should satisfy:

[0155] (1) P = Q = 3 mod 4;

[0156] (2) gcd(P — 1, Q — 1) — 2; and

[0157] (3) gcd(A, 0(A)) ~ 1.

[0158] Generating a conforming bi-prime requires only a minor modification to Chen et al., that will not affect security. The first condition is already satisfied by Chen et al., resulting in P ~ Q = 3 mod 4. The other two conditions may be satisfied by invoking the GCD (greatest common divisor) test sub-protocol, which receives one secret and one public value as input and outputs their GCD. The third condition may' be easily' achieved by applying that using that GCD test on inputs 0(A) (which is secret) and N (which is public) and verifying that the result is 1. To verify that the second condition is met, the inputs should be manipulated, since both are secrets. It is first noted that gcd = 2 is equivalent to: gcd = 1. It is further noted that g ( j ) g ( Accordingly, the GCD test may be applied on the secret value Q — 1 and the public value A — 1. Notably, this additional check may be efficient, and may fail with a probability of approximately « Therefore, there may be almost no effect on the time complexity of the key generation.

[0159] Then, using the obtained values above, the parties may generate the secret key d and the verification keys. It is noted that the secret key should satisfy d = 0 and d = 1 mod. N. As 00V) is already shared by the parties, such a secret key may be obtained by computing mod which satisfies both constraints: d ~ 0 mod0(N) is satisfied as it is a mul tiple of and d = 1 mod N is satisfied as (guaranteed by the fact that N is a conforming bi-prime) and so 1 mod N.

[0160] The parties may obtain a sharing of d using standard techniques. It can also be shown how the parties obtain the verification keys Vj, which will be briefly described. During the key generation phase the parties obtain ( ) for every j, where “Enc” represents an El-Gamal encryption scheme and pk is a joint encryption public key that was previously generated by the parties. Then, the parties sample random base , and finally each party’ publishes and proves that c, is an encryption o The language LEQ has been formally’ described in publications and the zero-knowledge protocol πEQhas been presented. It is noted that a same technique as described in Hazay et al. may be used for a threshold Paillier protocol, such that whenever a party sends a decryption share , it also provides a proof that is an encryption of This, however, may result in an inefficient threshold decryption protocol, as such a proof may be at least 64 times more expensive than the proof of the language LEDL used in the present STPC scheme (described hereinbelow).

[0161] Zero-Knowledge Proof of Equality of Discrete Logs

[0162] The following presents a proof of equality of discrete logs, which may be utilized to prove the validity of threshold decryptions by the parties. Notably, defining the appropriate language is somewhat subtle.

[0163] Formalizing the Language

[0164] Say that d, the secret decryption key, is upper bounded by Thus, is defined as the upper bound on the shares where

[0165] The naive approach: where is the (public) prover’s statement, N^g^ a are the language’s parameters, and x' is a witness. The meaning of these values follows:

[0166] ® are the base elements chosen in the distributed key generation (DKG) phase.

[0167] ® is the verification key associated with the prover Pj.

[0168] ® is a witness known by the prover Pj (note that soundness is proven and not knowledge soundness).

[0169] * = ct is the ciphertext to be decrypted.

[0170] * s the claimed partial decryption of the prover Pj.

[0171] The above formalization raises two issues:

[0172] 1. The Paillier ciphertext and so it would be most natural to prove equality of discrete logs over this group. However, since is not a cyclic group, the subgroup is worked over, which raises another issue: deciding membership to QRN2 is assumed to be a computationally hard problem, known as a quadratic residuosity problem (QRP).

[0173] 2. The goal of the zero-knowledge proof of the language is to make sure that the prover provides such that Since g!might not contain a generator of

[0174] QRN2, it may be that for ev ery

[0175] In such a case an adversary may find α. This means that for some h's, selecting picking n the language although

[0176] To solve the first issue, in the DKG and threshold decryption phases the parties may publish the roots of the elements, and prove statements on their squares. This may ensure that the whole proof holds over It is noted that there is no need to roll back and prove any statement in

[0177] Instead, after combining the (squared) decryption shares, the reconstructed plaintext will end up being multiplied by 2, and so a final multiplication by mod N is needed to restore the plaintext. To be more specific, random elements is sampled and published in the DKG phase, and it is established that g Similarly it is established tha Finally, it is established that Under the new syntax, the following applies:

[0178] 1. g1is some vector of elements chosen from in the DKG phase, and

[0179] 2. a = gdt is the verification key vf- associated With the prover Pj, which is generated in the DKG phase. 3. is a witness known by the prover P,.

[0180] 4.

[0181] 5 is the claimed partial decryption of the prover Pj.

[0182] It follows that logftand to make sure that the language is defined with (instead of g, h, b):

[0183] A side effect of this formulation is a shorter witness. In other words, in Equation 2 the witness wa whereas for Equation 3 the witness is x ~ dj.

[0184] To address the second issue, a soundness argument provided hereinbelow (in Theorem 4.8) may imply that g, a] for every } provided by the (potentially malicious) prover. Accordingly, it may essentially be proven that the prover must use d. as its witness in order for the verifier to accept.

[0185] Setup Phase

[0186] A “Setup” algorithm for generating the parameters of the language is hereby defined.

[0187] The setup is divided into two separate phases t phase is responsible for generating the conforming bi ond phase is responsible for generating all the rest, give The Setup algorithm takes as inputs and outputs:

[0188] » a conforming bi-prime

[0189] » g' is drawn uniformly at random from and compute It is noted that g does not necessarily contain a generator of

[0190] « x is drawn from

[0191] ®

[0192] It is noted that g'2is a random vector of elements in due to the absence of a known algorithm for computing a generator within this group. This observation may underscore the challenge previously discussed, as conventional protocols for the equality of discrete logarithms with a low soundness error typically assume g contains a generator. This challenge may be addressed by demonstrating that a randomly selected vector of elements contains an “almost generator” of the group with overwhelming probability, as defined hereinbelow:

[0193] Definition 4.1 Le be a conforming bi-prime, let g ∈ Seting g ~ Corollary 4.3 provided below implies that g contains a almost generator with a probability > 1 — Itturns out that assuming g to contain an almost generator may suffice to obtain a low' soundness error.

[0194] Lemma 4.2 Let be a cyclic group and let g ∈

[0195] By Lemma 4.2, letting then is ~smooth with probability greater than

[0196] Corollary 4.3 Let be a cyclic group, g ∈

[0197] To conclude, the algorithm may fail with a probability of 2~ff. Specifically, failure means that either N is not a bi-prime or g does not contain a -almost generator. The modulus generation phase can be taken to provide a failure probability’ of which by the union bound gives the desired failure probability.

[0198] The Protocol

[0199] A formal definition is provided in Protocol 4.1 :

[0200] Protocol 4.1

[0201] Inputs. ( g ) ( g ) g ) arbitrary Denote and

[0202] Protocol.

[0203] 1. IP samples [2 2and sends

[0204] 2. V samples e [0, 2K) and sends e to P.

[0205] 3. P sends z = r — e ■ x to V.

[0206] 4. V verifies that: (it suffices to check that h, b, v, ulf••• 0 mod N as otherwise these values can be used to factor N);

[0207] The following may be proven:

[0208] Theorem 4.4 The protocol (Protocol 4.1) is a zero-knowledge argument for relation EDL2under the factoring assumption.

[0209] Proof The following describes that all the properties of a zero-knowledge proof of relation are satisfied.

[0210] Completeness:

[0211] Let (N, g, a'; x) be the output of Setup(lK, 1CT), then, for every the protocol transcript is accepting. The range check of h, b, u, v may go through, as well as the range check of z, which follows immediately from the ranges of r, e, x. It then follows that: and

[0212] Special Honest-verifier zero-knowledge (SHVZK ):

[0213] It is shown that there exists a PPT simulator T. such that for every (h, b) E it holds that: [~~22KD, +22KD~). In the following it is shown that z and z' are statistically closed for every x and e. The distribution of z is as follows:

[0214] Soundness:

[0215] The following are used for the Soundness proof:

[0216] Corollary 4.6 Let Factor be a factoring algorithm.

[0217] There exists an algorithm Factor’ that, given inputs N, x, e such that

[0218] « N = PQ is a conforming bi-prime; and

[0219] ® x G QRN2 satisfies x 1 mod N2, e 0, but xe~ 1 mod N2, outputs P, Q and has a time complexity: t ime(F actor' (N , x, e)) ≤ time(F actor (e)) + polylog(N').

[0220] Lemma 4.7

[0221] A proof will be provided for the following Theorem:

[0222] .As noted earlier and demonstrated in Lemma 4.2, “Setup” generates a non-conforming bi-prime N or which does not contain a almost generator with a probability of at most However, the setup phase occurs only once, and the prover cannot affect its outcome, Assuming the setup phase succeeds and that the factoring problem is hard, the theorem states that the probability of a malicious pro ver cheating the verifier is neg(k). The distinction between the probability of the setup failing and the probability of the prover cheating plays a crucial role in a subsequent description of a “Fiat-Shamir Transform for Batched Proofs” where a Fiat-Shamir Transform is applied to make the protocol non-interactive.

[0223] In addition, the theorem states that except for a negligible probability, if the verifier accepts the proof then the prover not only provided but also it used the specific witness x that is given from Notably, there may exist statements for which an adversary is able to convince the verifier. However, this may not contradict the above theorem since such statements may be computationally hard to find, as it reduces to factoring N.

[0224] Before proving Theorem 4.8, a proof is provided for a similar statement, where N is fixed and tP* is deterministic:

[0225] Lemma 4.9 There exists an oracle machine with the following property:

[0226] Proof First an algorithm called is introduced, such that for every deterministic prover , the machine has a time complexity of (following the notations of Lemma 4.9).

[0227] The purpose of algorithm is to find an element and an exponent 0 < such that and is a -smooth number. It is shown that does so with probability of at least

[0228] An algorithm that applies is to factor N is then described.

[0229] .Algorithm works as follows:

[0230] ® Receiving the claim: calls and receives h and b.

[0231] Since is deterministic and is fixed, the values h and b are fixed as well. Since with a positive probability, it may be deduced that The following is denoted

[0232] « Receiving the proofs: call and receive s a (deterministic) claim then forks the protocol and sends at mos random challenges, until receiving the first valid response. If none of the responses is valid, then outputs the failure symbol . Otherwise, for one of the challenges it receives a valid response. In this case, forks the protocol and sends the challenges If none of the responses to these challenges is valid, then outputs 1. Otherwise, has two accepting transcripts (e, , z2), such that Output

[0233] The ti me complexity of is dominated by that of IP* and the exponentiation by x modulo N2, and is hence bounded may be proven that whenever df does not return 1, its output is valid with a high probability. Clearly, d 1, so it remains to be shown that ord smooth number.

[0234] Since the transcripts are both accepting, the following equations hold (modulo N2):

[0235] Since g contains a -almost generator, one may select and set g = gtand a = , and deduce that g is a -almost generator with a probability of at least ~ For which by Lemma 4.5, there exists an element g E QRN2, such that ord(p) is -smooth and {g, g) = Therefore, there exists and consequently :

[0236] Recall that a, d\ g are unknown to . Dividing the second equation by the first equation raised to the power of a results in the following: (Equation 4).

[0237] Recalling tha the following may be deduced:

[0238] Then, substituting in Equation 4, the following is obtained:

[0239] Finally, raising to the power of ord(rf), it is concluded that:

[0240] Since j it may be concluded that It rem ains to bound the probability that succeeds. With probability' of at leas selects g ~ ffi which is a almost generator, otherwise it will be assumed that it fails. In the first part, sends challenges. Since * is deterministic, an “accepting challenge” may be defined to be a challenge e for which * returns a valid response. Each of the challenges is accepting with probability at least ∈ , and the challenges are independent, so the probability that none of them is accepting is at most

[0241] 0.37. Otherwise, receives which is sampled uniformly from the set of the accepting challenges. In the next step, sends the challenges and fails if none of them is accepting. The variable denotes the number of accepting challenges for which all the challenges are not accepting, and bound €: The distance between any such two accepting challenges is at 2 . . least and they all he in , implying tha There are at least e2Kaccepting challenges, such that the probability that a uniform accepting transcript fails in this step is at most:

[0242] To conclude, succeeds with probability at least

[0243] Now, the required algorithm is described. calls and obtains d and e!as above with a probability of at least If outputs 1 then outputs 1. Otherwise, obtains elements d and such that ord

[0244] 1 mod N2, then by Corollary 4.6, may factor N in time complexity time Otherwise, obtains that the element -smooth order. Thus, by Lemma 4.7, may factor N with time complexity

[0245] Theorem 4.8 may now be proven as follows:

[0246] Proof Let P* be such as prover denotes the deterministic prover obtained by fixing the random tape of denotes the random tape of the verifier V. denotes the oracle machine described in Lemma 4.9.

[0247] Further denoted is:

[0248] If N is a conforming bi-prime and2contains a -almost generator, and p(m, N, g, a, x) = 0 otherwise.

[0249] First, for , denote and describe an algorithm that receives N, samples (according to Setup2), and tries to factor N assuming Algorithm works as follows: 1. Sample

[0250] 2. Call and return its output. By Lemma 4.9, Moreover,

[0251] K — 2 then outputs a non-trivial factorization of N with a probability of at least Next, it is claimed that for every / <, there exists such that:

[0252] It is assumed by contradiction that no i satisfies this inequality. Since Setup fails with probability at most the following is obtained:

[0253] However, this value of i.

[0254] A non-uniform algorithm is further defined as follows:

[0255] 1.

[0256] 2.

[0257] _ „ ,, , , . . . ,

[0258] It follows that succeeds with probability such that

[0259] Finally, it is observed that advice(K) can be computed in This can be done by running sampled random tapes , and observing which i succeeds in factorization. Hence, one can define a uniform adversary that computes advice (K) and then calls yielding time where is the success probability of rather than

[0260] Batching techniques may allow a prover to convince a verifier of the correctness of many statements in an efficient way, i.e., much faster than it would take to prove (and verify) each statement alone. In the context of threshold decryption, a good batching technique may shift the bottleneck from the verification of the validity of a partial decryption to the combination of the parties verified partial decryption into the plaintext.

[0261] It is recalled (from Protocol 4.1 ) that proving requires raising g and h to the power of r, which is a large exponent. Then, without batching, proving B statements requires performing 2B exponentiations with large exponents: namely, raising g and each hi to the power of the corresponding large exponent To improve efficiency, the “small exponent (SE)” technique may be applied. The idea of the SE technique is to combine the statements into a single statement using a random linear combination, such tha t h and and then use Protocol 4.1 only once, on the combined (h, b). Hence, raising to the power of a large exponent r happens only twice, just like in a proof of a single statement. The efficiency gain by that combination depends on the size of the coefficients tt, which is shown can be much smaller than the size of r without increasing the soundness error of the proof. The resulting proof of B statements requires the prover to raise 2B times to the power of a small exponent and then only twice to the power of a large exponent (instead of raising 2B times to the power of a large exponent). The same efficiency gam also affects the computational cost of the verifier.

[0262] Similarly to Theorem 4.8, the notion of conforming bi-primes is used and a reduction to the factoring problem is presented, without assuming N is a safe bi-prime. Intuitively, the soundness of the batched protocol relies on the fact that it is not possible for the prover to pick statements of which at least one is incorrect, such that their random combination x) is a correct statement (except for a negligible probability).

[0263] It is noted that using the small exponents technique requires the verifier to pick the coefficients tionly after the prover committed to its statements, which incurs two additional rounds over Protocol 4.1 . It will be shown, however, that even this protocol (with five rounds) can be turned non-interactive using the Fiat-Shamir transform without significantly increasing soundness error.

[0264] The batched proof equality of discrete logs is formally described in Protocol 4.2:

[0265] Protocol 4. Batched Proof for inputs. P has ( has ( and arbitrary

[0266] Protocol.

[0267] 1. V checks tha and send to P for every

[0268] Then P and V compute l

[0269] 2. P and V run (Protocol 4.1) to prove

[0270] Completeness follows by the fact that if f for all then . As for HVZK, it is shown that for every such that for all i, there exists a PPT simulator , such that:

[0271] The simulator simply computes h and b as in the protocol, and runs the simulator associated with (Protocol 4.1) on and outputs as output by that simulator. The transcript produced by S and the one under the real execution are statistically close with the exact same analysis as in the proof of Theorem 4.4.

[0272] The following is an argument for soundness:

[0273] Theorem 4.10 be a stateful prover such that;

[0274] Notably, if for some i, then (recall the definition of from Section 4.1) and Protocol 4.2 may succeed. However, as mentioned earlier, decryption shares are squared before being used, so multiplying a decryption share by (-1) does not affect the decryption.

[0275] Proof For brevity, the event that the prover attempts to cheat the verifier (assuming a successful setup) is denoted by: and the event that P* breaks soundness is denoted by:

[0276] Then, the theorem states that is negligible, because: Hence, Pr[Break] is bounded by the sum of ] | ]

[0277] Theorem 4.8 provides that ), otherwise an adversary who breaks the soundness of may be constructed (Protocol 4.1). In addition, by Lemma 4.11 (hereinbelow), assuming factorization is hard, which concludes the proof.

[0278] Lemma 4.11 Let Pf be a PPT for which: and only if ~ which is equivalent to By isolating the i0= 1 term, the following is obtained:

[0279] (Equation 5).

[0280] There exists a choice of t2, ••• tB, for which Equation 5 holds with a probability of at least ε where t1is uniformly distributed. Therefore, there exists at least EM choices of [0, M) such that yields the same result. Assuming it may be deduced that < To conclude, While is known to , its order mav not be known. Nevertheless can find the order using Pollard’s rho algorithm with a time complexity of Next, has an element 1 mod N2, and knows its order, which is Therefore, A can factor ord I (naively) in time Therefore, by Corollary 4.6, A can factor N in time

[0281] The following table (Table 2) presents possible parameter instantiations for the disclosed STPC scheme and computed concrete statistical and computational security ensured by following the reductions.

[0282] Table 2:

[0283] The possible parameter instantiations for the disclosed STPC scheme is provided with 40. The computational security parameter is controlled by the complexity of factoring (e.g., by NSIT) as a function of the modulus size The non-uniform reduction in Theorem 4.8 suggests a multiplicative overhead of 32CK. The statistical security of the DKG (distributed key generation) is controlled by c, the number of -almost generator candidates.

[0284] Batch verification is a technique that allows a verifier to simultaneously verify proofs from multiple non-interactive provers, thereby reducing computational load. It is somewhat analogous to the batching procedure done using the “small exponent” method, however since different provers have different verification keys aj, instead of digesting multiple exponentiation operations into a single one, a multi-exponentiation is obtained. Essentially, instead of validating two (or more) equations ~ 1 separately, one may sample randomizers and verify = 1, and with 1 — probability this implies the validity of both (or all) equations. An algorithm for computing is called a C-multi-exponentiation and can be computed more efficiently than performing C individual exponentiations (namely and then multiplying the results.

[0285] It is noted that if batch verification fails, the verifier does not know the identity of the cheaters, since all claims were merged into one. In that case, the verifier may “fall back” to verifying each proof individually.

[0286] The Fiat-Shamir Transform (FST) is a general tool which enables to transform any public-coin interactive proof into a non-interactive proof in the random oracle model (ROM). A proof with soundness error s becomes a proof with soundness error at most after the transform, where 2μ + 1 represents the number of rounds and Q is the number of oracle queries performed by the adversary. Protocol 4.1 indicates that μ = 1, which yields the bound to the soundness error. However, the batched ZKP protocol (Protocol 4.2) indicates that μ = 2, which results in a soundness error of 2~K / 2(i.e., for an adversary who queries the random oracle Q ~ times, the soundness error is at most 2*6). To achieve a soundness error of 2~Kafter the transform, one may aim to obtain a soundless error of e = 2~2Kin the interactive version, and then after the transform will result in a soundness error of 2 ~K. Therefore, a tighter bound is desired.

[0287] The increase of soundness error may be inevitable for certain protocols (e.g., the non-parallel fc-fold repetition of a ∑ protocol), but this is not the case for all multi-round protocols. In particular, if a protocol has special soundness” then applying the Fiat-Shamir Transform does not admit a large increase in soundness error. The following provides an explanation for why Protocol 4.2 may fit that definition.

[0288] Definition 4.12 2μ + 1 rounds public coin interactive proof n for relation R, w a set of

[0289] A 2μ + 1 rounds public coin interactive proof II for relation R where V samples the challenge from a set of cardinality Nj > kt, is said to have special soundness' if there exists of accepting transcripts outputs a. witness w such that (x, w) ∈ R with overwhelming probability.

[0290] It is noted that the present case is not intended to achieve knowledge-soundness (i.e. extraction of the witness), but rather is intended to achieve a break of the factoring problem. By the following theorem, applying the Fiat-Shamir Transform on a protocol with -spedal soundness only increases soundness error by a factor of Q:

[0291] Theorem 4,13

[0292] The Fiat-Shamir transformation of special soundness interactive proof ∏ with soundness 2~K, has soundness of

[0293] By examining the proof of soundness of Protocol 4.2 (and particularly the proof of Theorem 4. 10), one can observe that the protocol has a (2,2)-out-of-(2K, 2K)-special soundess and so the FST does not affect it significantly.

[0294] It should be noted that the FST is not applied on the setup phase that generates (A, g, a; x). Consequently, any potential attacker cannot influence the failure probability of this phase, which remains at most 2~ff, This may illustrate why one may opt for σ to be significantly smaller than K, as it serves as a statistical bound rather than a computational one.

[0295] An evaluation of the performance of the disclosed STPC scheme was performed. The evaluation used a number of parties n, varying from 10 to 1000, and batch sizes B varying from 1 (without batching) to 1000. Where applicable, a threshold of t = (2 / 3)n was used. All experiments were conducted over two machine types: an AWS EC-2 instance of type “c61.24x1arge” with 96 3rdgeneration Intel Xeon Scalable vCPUs @ 3.50 GHz, and a MacBook Pro Apple Ml Max with 10 Cores @ 3.22GHz. The evaluation used a 2048-bit bi-prime modulus N (equivalent to 4096-bit Paillier modulus N2) where the secret Paillier decryption key is (t, n)-Shamir shared over the integers using the tighter bound on the coefficients. All presented runtimes are the average over 10 runs.

[0296] As presented earlier in Table 1, existing protocols which are based on standard hardness assumptions and do not assume a trusted dealer, may closely resemble the disclosed STPC scheme but require extensive repetitions. Consequently, a performance comparison with such existing protocols is unnecessary and the disclosed scheme may be considered more efficient. Instead, a performance comparison is provided with an “ideal” protocol of a semi-honest model with no proofs.

[0297] Reference is now made to Figures 6 and 7, and corresponding Tables 3 and 4. Figure 6 illustrates a pair of graphs, referenced 210, 220, depicting the time to generate a decryption share with and without proof of equality of discrete logs, as measured in performance evaluations implemented on two types of machines, operative in accordance with an embodiment of the present disclosure. The vertical axis of graphs 210, 220 represents the runtime in milliseconds for a single party to produce B decryption shares (for B different ciphertexts) when there are n parties, and the horizontal axis represents the batch size for the performance evaluation. Figure 7 illustrates a pair of graphs, referenced 230, 240, depicting the time to combine decryption shares from parties of B ciphertexts, with and without proof of equality of discrete logs, as measured in performance evaluations implemented on two types of machines, operative in accordance with an embodiment of the present disclosure. The vertical axis of graphs 230, 240 represents the runtime in milliseconds for combining the B decryption shares from parties, and the horizontal axis represents the batch size for the performance evaluation.

[0298] Graph 210 (Fig.6) and graph 230 (Fig.7) represents an evaluation implemented on an AWS machine as specified earlier, and graph 220 (Fig.6) and graph 240 (Fig.7) represents an evaluation implemented on a MacBook Pro (MBP) Ml machine as specified earlier. For each of graphs 210, 220, 230, 240, plot “A” represents n=10 parties in the presence of a malicious adversary, plot “B” represents n==10 parties in the presence of a semi-honest adversary, plot “C” represents n=100 parties in the presence of a malicious adversary, plot “D” represents n=100 parties in the presence of a semi-honest adversary, plot “E” represents n=1000 parties in the presence of a malicious adversary, and plot “F” represents n::::l 000 parties in the presence of a semi-honest adversary. The decryption share with a proof of equality of discrete logs may be considered equivalent to the presence of a malicious adversary, while the decryption share without a proof of equality of discrete logs may be considered equivalent to the presence of semi-honest adversary.

[0299] Table 3 below specifies the computation times (runtimes) to produce B decryption shares when there are n parties (and up to t = (2 / 3)n are corrupted), corresponding to the graphs 210, 220 of Figure 6.

[0300] Table 3:

[0301] Table 4 below specifies the computation times (runtimes) to combine a batch of B decryption shares (for t-out-of-n Shamir sharing with t = (2 / 3)n), corresponding to the graphs 230, 240 of Figure 7.

[0302] In each of Table 3 and Table 4, “SH” represents a “semi-honest adversary” and “Mai” represents a “malicious adversary”, where the “Mai” column includes the time requires to verify the proof, and the “X” column indicates the overhead factor Mal / SH.

[0303] Further reference is made to Table 5 below, which illustrates proof verification time in milliseconds when there are n parties (of which t provides their proofs), each providing a batch proof of B decryption shares. Table 5:

[0304] Apart from runtime, the performance evaluations indicate the secret key decryption size and the proof size in bits, which both depend on the number of parties. For n={10, 100, 1000} parties, the size in bits of the key d (which is shared over the integers) is {4295, 5324, 19937} and the proof size in bits is {12743, 13772, 28385}.

[0305] It is noted that in all of graphs 210, 220, 230, 240 (and corresponding Tables 3, 4), the number of parties n affects the run time. This is due to the fact that n affects the party share size of the Paillier decryption key when shared over the integer, which in turn affects both exponent size of both the prover and the verifier. An abrupt jump in runtime may be observed when increasing from a batch of 100 ciphertexts to a batch of B2==l 000 ciphertexts in the AWS Ci6 machine, and when increasing from a batch of B-,:=:10 ciphertexts to a batch of B2:=:100 ciphertexts in the MBP Ml machine. This jump may be due to the parallelism of the implementation, which utilizes up to 96 cores of the A WS Ci6 machine, and up to 10 cores of the MBP Ml machine. Up to ciphertexts, the workload is quite concurrent and runs simultaneously for all ciphertexts in the batch, whereas above B1ciphertexts the work becomes sequential.

[0306] Figures 6 and 7 also demonstrate that adding protection against a malicious adversary does not incur a high overhead. For all n and B, this overhead is a small constant and as n and B grow (e.g., toward n=1000 or B=1000) this constant reaches 1.5. The precise factors are presented in Table 3 under the “x” column.

[0307] The batching technique (along with the multi-exponentiation) may prove itself necessary’ if a truly scalable solution is needed. For decryption share computation (Table 3) with n={10, 100, 1000} , the time for the pro ver to generate a decryption share for a single ciphertext is {134, 355, 1434} milliseconds on the MBP Ml machine, respectively. When generating decryption shares for B=1000 ciphertexts, the cost is only {12.5, 32.5, 144} milliseconds for each one, respectively, which is about a lOx improvement. Similar results are obtained for the combination of decryption shares (Table 2) and for proof verification (Table 4).

[0308] It is appreciated that the disclosed embodiments relate to a novel security reduction technique, from the soundness of the proof of equality of discrete logs to the factoring problem. Combining the disclosed zero-knowledge proof (and its batching capabilities) with a large- scale modulus generation, it is shown that a threshold Paillier encryption scheme may be practical under standard assumptions. Moreover, the threshold Paillier encryption scheme may be considered not only practical, but also ready for a large-scale deployment with thousands of parties. The disclosed STPC scheme may be applied in a decentralized network, such as a blockchain system or a large-scale secret information system.

[0309] While certain embodiments of the disclosed subject matter have been described, so as to enable one of skill in the art to practice the present disclosure, the preceding description is intended to be exemplary only. It should not be used to limit the scope of the disclosed subject matter, which should be determined by reference to the following claims.

Claims

CLAIMS1. A method for threshold Paillier distributed key generation, the method comprising the steps of: generating a Paillier public key N comprising a bi-prime modulus for largeprimes P, 0, such that:1; and generating a Shamir secret sharing over integers of a Paillier private key d satisfying = 1.

2. The method of claim 1, wherein GCD(d, N) — 1 comprises d = 1 mod N.

3. The method of claim 1 , wherein for each party P; of a plurality of parties Pj, the method further comprises the steps of: sampling random bases andpublishing a verification key4. A method for threshold Paillier encryption, the method comprising the step of: encrypting a message to produce a ciphertext using a Paillier public key “N" comprising a bi-prime modulus P PQ. for large primes P, Q, such that: P = Q = 3 mod 4;5. A method for threshold Paillier homomorphic linear evaluation, the method comprising the step of: applying a homomorphic evaluation of a linear function f on a group of ciphertexts using a Paillier public key “N” comprising a bi-prime modulus N--PQ, for large primes P, Q, such that:

6. A method for threshold Paillier decryption, the method comprising the steps of: sending at least one decry ption share of a ciphertext (ct) from at least onerespective party Pj, wherein ct is in and wherein d is a Paillier private key with Shamirsecret sharing over integers of d satisfying) = 1 ; and after collecting a threshold of t out of n decryption shares, decrypting the ciphertext to produce a plaintext by performing a reconstruction of Shamir secret sharing in exponent.

7. The method of claim 6, wherein sending at least one decryption share further comprises sending with the decryption share a zero-knowledge (ZK) proof that ctj is computed correctly using the public ciphertext (ct) and private key share d, of party Pj, wherein the ZK proof comprises an equality of discrete logs proof of values tty and vj over QRN2, with respect to the bases ct and g, whereinand wherein v< is averification keyand wherein decrypting the ciphertext is performed after verifying the ZK proofs of the received decryption shares, and after collecting a threshold of verified t out of n decryption shares.

8. The method of claim 6, wherein sending the decryption shares is implemented by a first entity, and collecting the decryption shares and decrypting the ciphertext is implemented by a second entity.

9. The method of claim 7, wherein a single party proves a plurality of decryption shares to securely run threshold decryption of a plurality of ciphertexts in parallel, using batching.

10. The method of claim 7, further comprising performing batch verification of the ZK proofs, wherein verifying the ZK proofs comprises a single verifier validating a plurality of ZK proofs from different parties, using at least one multi-exponentiation technique.

11. The method as in any of the claims I to 10, applied in a decentralized network.

12. The method as in claim 11 , wherein the decentralized network is selected from the group consisting of: a blockchain system, and a large-scale secret information sharing system.

13. A system for threshold Paillier distributed key generation, the system comprising: a processor, configured to receive a request to execute a Paillier distributed keygeneration; and a key generation module, configured to generate a Paillier public key N by applying a bi-prime modulusfor large primes P, Q, such that: P = Q = 3 mod 4; ; and to generate a Shamir secret sharingover integers of a Paillier private key d satisfying:

14. The system of claim 13, wherein15. The system of claim 14, wherein for each party Pj of a plurality of parties Pj, the key generation module is further configured to: sample random basespublish a verification key16. A system for threshold Paillier encryption, the system comprising: a processor, configured to receive a request to execute a Paillier encryption; and an encryption module, configured to encrypt a message to produce a ciphertext using a Paillier public key “N” comprising a bi-prime modulus N=PQ, for large primes P, Q, such that:

17. A system for threshold Paillier homomorphic linear evaluation, the system comprising:a processor, configured to receive a request to execute a Paillier homomorphic linear evaluation; and a homomorphic linear evaluation module, configured to apply a homomorphic evaluation of a linear function f on a group of ciphertexts using a Paillier public key “N” comprising a bi-prime modulus N=PQ, for large primes P, 0, such that: P — Q = 3 mod 4;18. A system for threshold Paillier decryption, the system comprising: a processor, configured to receive a request to execute a Paillier decryption; and a decryption share generation module, configured to send at least one decryption shareof a ciphertext (ct) from at least one respective parly Pj, wherein ct is inand wherein d is a Paillier private key with Shamir secret sharing over integers of d satisfying: = 1 , anda decryption share combination and computation module, configured to collect a threshold of t out of n generated decryption shares, and to decrypt the ciphertext to produce a plaintext by performing a reconstruction of Shamir secret sharing in exponent.

19. The system of claim 18, wherein the decryption share generation module is further configured to send with the decryption share a zero-knowledge (ZK) proof that ct, is computed correctly using the public ciphertext ct and private key share dj of party Pj, wherein the ZK proof comprises an equality of discrete logs proof of values ctj and v, overwith respect to the bases ct and g, whereinand wherein y is a verification key , andwherein the decryption share combination and computation module is configured to decrypt the ciphertext after verifying the ZK proofs of the received decryption shares, and after collecting a threshold of verified t out of n decryption shares.

20. The system of claim 18, wherein the decryption share generation module is implemented by a first entity, and the decryption share combination and computation module is implemented by a second entity.

21. The system of claim 19, wherein a single party proves a plurality of decryption shares to securely run threshold decryption of a plurality of ciphertexts in parallel, using batching.

22. The system of claim 19, further comprising a party configured to perform batch verification of the ZK proofs, wherein verifying the ZK proofs comprises the party validating a plurality of ZK proofs from different parties, using at least one multi-exponentiation technique.

23. The system as in any of the claims 17 to 22, further comprising: a decentralized network that performs one or more operations.

24. The system as in claim 23, wherein the decentralized network is selected from the group consisting of: a blockchain system and a large-scale secret information sharing system.

Images