Talk:Paillier cryptosystem

message: The update to encryption, where r \in Z^{*}_{n^{2}}, is added due to the discussion here.  This is only relevant to small "lecture-sized" keys, e.g., p=11, q=13.  With large key sizes, e.g., 1024-bit, the probability of r being a multiple of p or q is negligible.  Still, it is important to add this caveat especially for students new to this cryptosystem.  See https://crypto.stackexchange.com/a/62378/49011. 100.36.66.167 (talk) 03:47, 17 September 2018 (UTC)
replies: text: Not sure, whether it is an error or an attempt to make the description easier to understand. What is really neccessary is that r^n is a random element of the subgroup of order \varphi(n) of \mathbb Z^{*}_{n^{2}}. This can either be achieved by selecting a random element r\in\mathbb Z^{*}_{n^{2}}  or by selecting 0<r<n such that \gcd(r,n)=1. That the later is possible follows from (r+kn)^n\equiv r^n\pmod{n^2}. 85.0.108.196 09:04, 24 April 2007 (UTC)

text: That's because the pair p=7,q=29 is not an "admissible" combination. To be admissible choices for p, q, must satisfy \gcd(n, \varphi(n))=1. This criterion appears to have first been explicitly stated in . As the authors point out, "When p,q, are large and randomly chosen, this will be satisfied, except with negligible probability."  Primepq (talk) 19:28, 29 August 2009 (UTC)
thread_title: Article Accuracy

message: It says that this algorithm can be used in an election where a user select 1 or 0 as a vote. But what happens if the user selects 2 instead ? or 5000 for what it matters ? I seen nothing forbidding it. How can an official check this is not what happened ? --Iv (talk) 13:41, 19 March 2010 (UTC)
replies: text: Interesting question. According to these lecture notes, the voter must submit zero-knowledge proofs of his/her votes. -- intgr [talk] 18:26, 19 March 2010 (UTC)
thread_title: Electronic voting

message: Hello fellow Wikipedians,
I have just added archive links to  on Paillier cryptosystem. Please take a moment to review my edit. If necessary, add  after the link to keep me from modifying it. Alternatively, you can add  to keep me off the page altogether. I made the following changes:
*Added archive http://web.archive.org/web/20160106172152/http://www.rsasecurity.com/rsalabs/cryptobytes/CryptoBytes_January_2002_final.pdf to http://www.rsasecurity.com/rsalabs/cryptobytes/CryptoBytes_January_2002_final.pdf
When you have finished reviewing my changes, please set the checked parameter below to true or failed to let others know (documentation at ).
Cheers.—cyberbot IITalk to my owner:Online 11:15, 28 February 2016 (UTC)
thread_title:  External links modified 

message: Is it really necessary to write the random number r explicitly as an argument of encryption function?
For instance, the expression
:: D(E(m_1, r_1)\cdot E(m_2, r_2)\bmod n^2) = m_1 + m_2 \bmod n. \, 
could be simplified to
:: D(E(m_1)\cdot E(m_2)\bmod n^2) = m_1 + m_2 \bmod n. \, 
since the description of the encryption function makes it clear that the random number r is sampled when a message will be encrypted.
Lp.vitor (talk) 20:00, 29 August 2016 (UTC)
thread_title:  Why to write the parameter r explicitly ? 

message: It seems to me that there is a mixup between "plaintext" and "ciphertext" in the section "Homomorphic multiplication of plaintexts". I think that the sentence should read: "A ciphertext raised to the power of another ciphertext will decrypt to the product of the two plaintexts". Moreover I think "encrypted plaintext" is really a weird formulation anyway, it should be "ciphertext".  Ho33e5 (talk) 22:07, 20 September 2016 (UTC)
replies: text: Edit: my first remark is false, there is no mixup. But there is still the weird "encrypted plaintext". --Ho33e5 (talk) 10:19, 12 January 2017 (UTC)
thread_title:  Mixup between cipher and plain