Date post: | 05-Jan-2016 |
Category: |
Documents |
Upload: | phebe-hunt |
View: | 247 times |
Download: | 8 times |
Andreas Steffen, 17.12.2010, Paillier.pptx 1
E-Voting Seminar
The Paillier Cryptosystem
Andreas Steffen
Hochschule für Technik Rapperswil
Andreas Steffen, 17.12.2010, Paillier.pptx 2
Agenda
• Some mathematical properties
• Encryption and decryption
• Additive homomorphic properties
• Zero knowledge proof for n-th powers
• Paillier e-voting simulator
• Non-interactive ZKP using the Fiat-Shamir heuristic
• Damgård-Jurik Cryptosystem (Generalized Paillier)
• Damgård-Jurik JavaScript e-voting client
• Threshold decryption schemes
Andreas Steffen, 17.12.2010, Paillier.pptx 3
The Paillier Cryptosystem I
Proposed by Pascal Paillier in 1999:
• Choose two large prime numbers p and q and form the modulus
• Euler‘s totient function gives the number of elements in
• The number of elements in is
• The private key is determined using Carmichael‘s function
• Due to Carmichael‘s theorem, for every element
)1,1(lcm)( qpn
)1)(1()( qpn
*n
pqn
*2n
)()( 2 nnn
*2n
2mod1
mod1
n
nn
Andreas Steffen, 17.12.2010, Paillier.pptx 4
The Paillier Cryptosystem II
• The hard problem: Deciding n-th composite residuosity!
• The set of n-th residues is a multiplicative subgroup of of order
• Each n-th residue z has exactly n roots of degree n, among which exactly one is strictly smaller than n, namely
• The n-th roots of unity are the numbers of the form
• Generate the multiplicative subgroup as
)(n
2mod nyz n*
2n
*,mod nn rnzr
nm mnmnn ,mod1)1( 2
*2n
**2nnn
cnrgrm nm 2mod),( Paillier Encryption
m: plaintext message, r: random number for semantic security
Andreas Steffen, 17.12.2010, Paillier.pptx 5
Example: Multiplicative Subgroup
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 m
1 16 31 46 61 76 91 106 121 136 151 166 181 196 211 g^m
1 1 1 16 31 46 61 76 91 106 121 136 151 166 181 196 211
2 143 143 38 158 53 173 68 188 83 203 98 218 113 8 128 23
4 199 199 34 94 154 214 49 109 169 4 64 124 184 19 79 139
7 118 118 88 58 28 223 193 163 133 103 73 43 13 208 178 148
8 107 107 137 167 197 2 32 62 92 122 152 182 212 17 47 77
11 26 26 191 131 71 11 176 116 56 221 161 101 41 206 146 86
13 82 82 187 67 172 52 157 37 142 22 127 7 112 217 97 202
14 224 224 209 194 179 164 149 134 119 104 89 74 59 44 29 14
r r^n
*
152
p = 3, q = 5, n = 15, n2 = 225 Generator in most general form:(n) = 8, (n) = lcm(2, 4) = 4 *,,)1( n
nng
Andreas Steffen, 17.12.2010, Paillier.pptx 6
Paillier Decryption
• Apply the private key and use Carmichael‘s theorem
• Make use of the relationship
• Apply the L(x) function
nngL
ncLm mod
)mod(
)mod(2
2
mnmnm grgrgc )(
n
xxL
1)(
with
2mod)1()1())1(( nmnnng mnmmnm
mnm
nL
mnL
mod)1(
)1(
2mod1)1( nxnn x
Andreas Steffen, 17.12.2010, Paillier.pptx 7
Additive Homomorphic Properties
• Verification
nmmnmEmED mod)mod)()(( 212
21
2212121 mod)()( 2121 nrrgrgrgmEmE nnmmnmnm
nmknmED k mod)mod)(( 2
• Use in e-voting systems with homomorphic tallying:
The additive homomorphic property directly returning the tallyis the biggest advantage of the Paillier Cryptosystem over theEl Gamal Cryptosystem which has an intrinsically multiplicativehomomorphic property requiring the computation of a discretelogarithm over a bounded range to extract the tally.
Andreas Steffen, 17.12.2010, Paillier.pptx 8
• K valid voting messages (e.g. vote for one out of K candidates)
• Zero knowledge proof : Prove that uk is an n-th power
• Commitment: Prover chooses a random number
• Challenge: Verifier chooses a random bit string ei of
length b
• Response: Prover computes zi
• Verification:
Validity Proof of Ballot (Case: k = i)
kin
m
nm
mk mmrng
rg
g
cu
k
i
k
ifonly mod 2
*2 ,mod nn
i na
Kk mmmm ,,,,, 21
),min(2,2 qpe bbi
nrz iei mod
2mod nuaz ieii
ni
2mod)( nrrz ii ennneni
Andreas Steffen, 17.12.2010, Paillier.pptx 9
Validity Proof of Ballot (Cases: k i)
• Preparation: Prover chooses zk and bit string ek randomly
• Commitment: Prover computes ak so that it passes verification
• Challenge: Verifier chooses a random bit string e of
length b
• Response: Prover sends prepared zk and ek
• Verification:
2mod nu
za
kek
nk
k
),min(2,2,* qpez bbknk
),min(2,2 qpe bb
2mod nuaz kekk
nk
bK
kk ee 2mod
1
Prover can preselect all ek for
k i but is bound by e for thechoice of ei.
Andreas Steffen, 17.12.2010, Paillier.pptx 10
Paillier E-Voting Simulator
• http://security.hsr.ch/msevote/paillier
Andreas Steffen, 17.12.2010, Paillier.pptx 11
E-Voting Simulator – Tallying with ZKPs
Andreas Steffen, 17.12.2010, Paillier.pptx 12
Non-Interactive ZKP (Fiat-Shamir Heuristic)
Election ID
Voter ID
Encrypted Ballot c
SHA-256
Commitments ak
AES-256
Counter
Mode
Challenge Bit String e
256 bit key
Counter
Andreas Steffen, 17.12.2010, Paillier.pptx 13
• Additional parameter s (Paillier: s = 1)
• Generate the multiplicative subgroup as
• Generator usually chosen as g = (1+n)
• Size of modulus n: b bits (e.g. 1536 bits)
• Size of message m: sb - 1 bits (s=1: 1535 bits, s=2: 3071 bits)
• Size of ciphertext c: (s+1)b (s=1: 3072 bits, s=2: 4608 bits)
• Efficiency: = s/(s+1) (s=1: 50%, s=2: 67%, s=3: 75%)
The Damgård-Jurik Cryptosystem
cnrgrm snm s
1mod),(
m: plaintext message, r: random number for semantic security*
1 sn
**1 ss nnn
Andreas Steffen, 17.12.2010, Paillier.pptx 14
Damgård-Jurik JavaScript E-Voting Client
Andreas Steffen, 17.12.2010, Paillier.pptx 15
Damgård-Jurik JavaScript E-Voting Client
Andreas Steffen, 17.12.2010, Paillier.pptx 16
Commitment
Andreas Steffen, 17.12.2010, Paillier.pptx 17
Challenge Verification
Andreas Steffen, 17.12.2010, Paillier.pptx 18
Response Verification
Andreas Steffen, 17.12.2010, Paillier.pptx 19
Threshold Scheme with a Trusted Dealer
Andreas Steffen, 17.12.2010, Paillier.pptx 20
Threshold Scheme without a Trusted Dealer
• Practical threshold RSA signatures without a trusted dealer Ivan Damgard, Maciej Koprowski, 2001
• The distributed generation of an RSA private key required by a Threshold Paillier Cryptosystem is much more complex than the simple independent partial private key generation possible with the El Gamal Cryptosystem.