Linearly Homomorphic Encryption from $$\mathsf {DDH}$$

Abstract

We design a linearly homomorphic encryption scheme whose security relies on the hardness of the decisional Diffie-Hellman problem. Our approach requires some special features of the underlying group. In particular, its order is unknown and it contains a subgroup in which the discrete logarithm problem is tractable. Therefore, our instantiation holds in the class group of a non maximal order of an imaginary quadratic field. Its algebraic structure makes it possible to obtain such a linearly homomorphic scheme whose message space is the whole set of integers modulo a prime p and which supports an unbounded number of additions modulo p from the ciphertexts. A notable difference with previous works is that, for the first time, the security does not depend on the hardness of the factorization of integers. As a consequence, under some conditions, the prime p can be scaled to fit the application needs.

Encryption Switching Protocols Revisited: Switching Modulo p

“…Cryptosystems like Elgamal [17] or Paillier [19] satisfy all these properties. We will propose a variant of Elgamal and a variant of Castagnos-Laguillaumie [9] that satisfy also these properties in Section 5.…”

“…Both schemes enjoy an Elgamal structure. For the additively homomorphic encryption scheme, we will use as a basis the scheme introduced in [9] (denoted CL in the following). It uses the notion of a DDH group with an easy DL subgroup, which is instantiated using class groups of quadratic fields.…”

“…Castagnos-Laguillaumie encryption The encryption scheme from [9] is additively homomorphic modulo a prime p. The general protocol is well suited for relatively small p. For the ESP context, we need a large message space as p must be at least of 2048 bits for the security of the Elgamal protocol. As a result, we use the first variant of CL described in [9,Section 4]. This variant is defined with subgroups of the class group of an order of a quadratic field of discriminant ∆ p = −p 3 .…”

“…Working over Z/pZ has several advantages compared to Z/nZ (for an RSA modulus n): it means true message space equality, instead of computational equality. It also means faster arithmetic by carefully choosing the prime p. Our instantiation combines a variant of Elgamal together with the Castagnos-Laguillaumie additively homomorphic encryption from [9]. Because Elgamal is only secure in the subgroup of squares modulo p, our variant over Z/pZ * , denoted Eg * , encodes the messages into squares and adds the encryption of a witness bit (i.e.…”

“…the Legendre Symbol) under Goldwasser-Micali [23] for its homomorphic properties modulo 2. For Π + , we use a variant of the Castagnos-Laguillaumie encryption scheme (CL) described in [9,Section 4]. We work over (subgroups of) the class group of an order of a quadratic field of discriminant ∆ p = −p 3 .…”