Paillier Ciphertext Public Verification via Zero-Knowledge Proofs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The Paillier cryptosystem is not chosen-ciphertext secure, and existing solutions require private key knowledge for validating ciphertexts, which is a limitation in threshold environments where decryption servers lack the necessary private key.
Innovation Solution
A modified Paillier cryptosystem that includes generating a public key and private key using distinct primes p and q, computing a ciphertext c and verification values U and s using hash functions H and G, allowing public verification of ciphertext validity and enabling chosen-ciphertext security without requiring the private decryption key.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional Paillier encryption is used, then encryption and decryption can be performed, but the system is not chosen-ciphertext secure and ciphertext validity cannot be publicly verified
Solution Approach 1:
The encryption scheme is segmented into distinct components: a Paillier ciphertext c, a proof of plaintext knowledge U, and a proof of randomness s. Each component serves a specific security function, allowing the system to achieve chosen-ciphertext security while maintaining public verifiability through separate verification mechanisms for each component.
Solution Approach 2:
Zero-knowledge proofs serve as intermediary mechanisms that allow public verification of ciphertext validity without revealing the private decryption key. The proofs act as mediators between the ciphertext and the verification process, enabling public validation while preserving the secrecy of the private key.
2Ease of operation
If decryption key is required to verify ciphertext validity, then ciphertext validation can be performed, but threshold decryption servers lack the necessary private key
Solution Approach 1:
The verification capability is extracted from the private decryption key and made publicly accessible through zero-knowledge proofs. The proofs of plaintext knowledge and randomness can be verified by anyone with the public key, eliminating the need for threshold decryption servers to possess the private key for verification purposes.
Solution Approach 2:
The ciphertext structure includes self-verifying properties through embedded zero-knowledge proofs. The ciphertext can be validated by anyone using the public key and the proof components, making the verification process self-service and independent of the private key holder.
3Reliability
If additional verification components are added to achieve security, then chosen-ciphertext security is improved, but ciphertext size and processing complexity increase
Solution Approach 1:
The verification values U and s are computed using modular arithmetic with parameters derived from the Paillier modulus N. By using efficient modular exponentiation and hashing functions, the ciphertext size is kept manageable while achieving strong security. The proofs are constructed to verify security properties without requiring excessive data storage.
Data Source
Figure 1
AI summary
Various embodiments relate to a method of encrypting a message m using a Paillier cryptosystem, including: computing a ciphertext c based upon the message m, N, and r, where N is the product of two distinct primes p and q, and r is randomly chosen such that r ∈ [1, N); computing a first verification value based upon u and N, where u is randomly chosen such that u ∈ [1, N); computing a second verification value s based upon u, r, the ciphertext c, the verification value, and a hash function H.