From 622644f19d5aa89a0319a498c81a1518fcf5349a Mon Sep 17 00:00:00 2001 From: Piotr Dyraga Date: Wed, 23 May 2018 18:37:15 +0200 Subject: [PATCH 1/7] Fixed test for LCM The LCM test was expecting GCD result and because assertion was flipped (missing negation), the test was passing. --- paillier_test.go | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/paillier_test.go b/paillier_test.go index 1f3adcd..d8e8218 100644 --- a/paillier_test.go +++ b/paillier_test.go @@ -8,10 +8,11 @@ import ( ) func TestLCM(t *testing.T) { - a := big.NewInt(2 * 3 * 3 * 3 * 5 * 5) - b := big.NewInt(3 * 3 * 5 * 5 * 57 * 11) - exp := big.NewInt(3 * 3 * 5 * 5) - if reflect.DeepEqual(exp, LCM(a, b)) { + a := big.NewInt(1350) + b := big.NewInt(141075) + expected := big.NewInt(282150) + + if !reflect.DeepEqual(expected, LCM(a, b)) { t.Fail() } } @@ -35,7 +36,7 @@ func TestComputeMu(t *testing.T) { exp := big.NewInt(3) if !reflect.DeepEqual(computeMu(g, lambda, n), exp) { - t.Error("lambda is not well computed") + t.Error("mu is not well computed") } } From f550c00e74617c2110b537619a3d9d0a72645739 Mon Sep 17 00:00:00 2001 From: Piotr Dyraga Date: Wed, 23 May 2018 18:43:14 +0200 Subject: [PATCH 2/7] Added test for Lambda parameter computation --- paillier_test.go | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/paillier_test.go b/paillier_test.go index d8e8218..6eddacb 100644 --- a/paillier_test.go +++ b/paillier_test.go @@ -40,6 +40,16 @@ func TestComputeMu(t *testing.T) { } } +func TestComputeLambda(t *testing.T) { + a := big.NewInt(5) + b := big.NewInt(7) + expected := big.NewInt(12) + + if !reflect.DeepEqual(expected, computeLamda(a, b)) { + t.Error("lambda is not correctly computed") + } +} + func TestEncryptDecryptSmall(t *testing.T) { p := big.NewInt(13) q := big.NewInt(11) From d892a58e4bed45d5bb0c25d25fdab370106409c3 Mon Sep 17 00:00:00 2001 From: Piotr Dyraga Date: Thu, 24 May 2018 18:41:10 +0200 Subject: [PATCH 3/7] Cleared up Paillier scheme API MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The code for generating private key is based on approach described in [KL 08], construction 11.32 which is compatible with the one described in [DJN 10], section 3.2 except that instead of generating Lamda private key compontent from LCM of `p` and `q` we use Euler's totient function as suggested in [KL 08]. I cleared up naming as well as removed G and Mu parameters from Paillier key. For the modification of Paillier scheme we use, where g = n + 1, N is the only one parameter needed for a public key. Also, Mu is needed only for Decrypting and can be computed there from Lambda and N so there is no need to keep it in the private key. I added documentation to functions with an important note that `p` and `q` supplied to `CreatePrivateKey` must be either of equal length or `gcd(pq, (p-1)(q-1)) = 1` which is assured if both primes are of equal length. This requirement is mentioned both in [KL 08] and [DJN 10]. [KL 08]: Jonathan Katz, Yehuda Lindell, (2008) Introduction to Modern Cryptography: Principles and Protocols, Chapman & Hall/CRC [DJN 10]: Ivan Damgard, Mads Jurik, Jesper Buus Nielsen, (2010) A Generalization of Paillier’s Public-Key System with Applications to Electronic Voting Aarhus University, Dept. of Computer Science, BRICS --- encoding.go | 17 ++----------- paillier.go | 63 ++++++++++++++++++++++++++++++------------------ paillier_test.go | 63 ++++++++++++++++++++++-------------------------- 3 files changed, 71 insertions(+), 72 deletions(-) diff --git a/encoding.go b/encoding.go index df70725..11920fb 100644 --- a/encoding.go +++ b/encoding.go @@ -117,18 +117,13 @@ type dbPrivateKey struct { func (this *PrivateKey) GetBSON() (interface{}, error) { m := make(map[string]string) - if this.G != nil { - m["g"] = fmt.Sprintf("%x", this.G) - } + if this.N != nil { m["n"] = fmt.Sprintf("%x", this.N) } if this.Lambda != nil { m["lambda"] = fmt.Sprintf("%x", this.Lambda) } - if this.Mu != nil { - m["mu"] = fmt.Sprintf("%x", this.Mu) - } return m, nil } @@ -143,21 +138,13 @@ func (this *PrivateKey) SetBSON(raw bson.Raw) error { return err } } - if c.G != "" { - this.G, err = fromHex(c.G) - if err != nil { - return err - } - } + if c.Lambda != "" { this.Lambda, err = fromHex(c.Lambda) if err != nil { return err } } - if c.Mu != "" { - this.Mu, err = fromHex(c.Mu) - } return err } diff --git a/paillier.go b/paillier.go index 15b8cbb..134a0f4 100644 --- a/paillier.go +++ b/paillier.go @@ -26,10 +26,15 @@ func (this *PublicKey) GetNSquare() *big.Int { return this.n2 } -// Encode a plain text in a cypher one. The plain text must be smaller that -// N and bigger or equal than zero. random is usually rand.Reader from the +// Encode a plaintext in a cypher one. The plain text must be smaller that +// N and bigger or equal than zero. random is usually rand.Reader from the // package crypto/rand. // +// m - plaintext to encrypt +// E(m, r) = [(1 + N) r^N] mod N^2 +// +// See [KL 08] construction 11.32, page 414. +// // Returns an error if an error has be returned by io.Reader. func (pub *PublicKey) Encrypt(m *big.Int, random io.Reader) (*Cypher, error) { r, err := GetRandomNumberInMultiplicativeGroup(pub.N, random) @@ -38,7 +43,8 @@ func (pub *PublicKey) Encrypt(m *big.Int, random io.Reader) (*Cypher, error) { } nSquare := pub.GetNSquare() - gm := new(big.Int).Exp(pub.G, m, nSquare) + g := new(big.Int).Add(pub.N, big.NewInt(1)) + gm := new(big.Int).Exp(g, m, nSquare) rn := new(big.Int).Exp(r, pub.N, nSquare) return &Cypher{new(big.Int).Mod(new(big.Int).Mul(rn, gm), nSquare)}, nil } @@ -52,20 +58,28 @@ func (this *PublicKey) Add(cypher1, cypher2 *Cypher) *Cypher { type PrivateKey struct { PublicKey - Lambda, Mu *big.Int + Lambda *big.Int } func (this *PrivateKey) String() string { ret := fmt.Sprintf("g : %x", this.G) ret += fmt.Sprintf("n : %x", this.N) ret += fmt.Sprintf("lambda: %x", this.Lambda) - ret += fmt.Sprintf("mu : %x", this.Mu) return ret } +// Decodes ciphertext into a plaintext message. +// +// c - cyphertext to decrypt +// N, lambda - key attributes +// +// D(c) = [ ((c^lambda) mod N^2) - 1) / N ] lambda^-1 mod N +// +// See [KL 08] construction 11.32, page 414. func (priv *PrivateKey) Decrypt(cypher *Cypher) (msg *big.Int) { + mu := new(big.Int).ModInverse(priv.Lambda, priv.N) tmp := new(big.Int).Exp(cypher.C, priv.Lambda, priv.GetNSquare()) - msg = new(big.Int).Mod(new(big.Int).Mul(L(tmp, priv.N), priv.Mu), priv.N) + msg = new(big.Int).Mod(new(big.Int).Mul(L(tmp, priv.N), mu), priv.N) return } @@ -82,35 +96,38 @@ func L(u, n *big.Int) *big.Int { return new(big.Int).Div(t, n) } -func LCM(x, y *big.Int) *big.Int { - return new(big.Int).Mul(new(big.Int).Div(x, new(big.Int).GCD(nil, nil, x, y)), y) -} - func minusOne(x *big.Int) *big.Int { return new(big.Int).Add(x, big.NewInt(-1)) } -func computeMu(g, lambda, n *big.Int) *big.Int { - n2 := new(big.Int).Mul(n, n) - u := new(big.Int).Exp(g, lambda, n2) - return new(big.Int).ModInverse(L(u, n), n) -} - -func computeLamda(p, q *big.Int) *big.Int { - return LCM(minusOne(p), minusOne(q)) +func computePhi(p, q *big.Int) *big.Int { + return new(big.Int).Mul(minusOne(p), minusOne(q)) } +// CreatePrivateKey generates a Paillier private key accepting two large prime +// numbers of equal length or other such that gcd(pq, (p-1)(q-1)) = 1. +// +// Algorithm is based on approach described in [KL 08], construction 11.32, +// page 414 which is compatible with one described in [DJN 10], section 3.2 +// except that instead of generating Lambda private key component from LCM +// of p and q we use Euler's totient function as suggested in [KL 08]. +// +// [KL 08]: Jonathan Katz, Yehuda Lindell, (2008) +// Introduction to Modern Cryptography: Principles and Protocols, +// Chapman & Hall/CRC +// +// [DJN 10]: Ivan Damgard, Mads Jurik, Jesper Buus Nielsen, (2010) +// A Generalization of Paillier’s Public-Key System +// with Applications to Electronic Voting +// Aarhus University, Dept. of Computer Science, BRICS func CreatePrivateKey(p, q *big.Int) *PrivateKey { n := new(big.Int).Mul(p, q) - lambda := new(big.Int).Mul(minusOne(p), minusOne(q)) - g := new(big.Int).Add(n, big.NewInt(1)) - mu := new(big.Int).ModInverse(lambda, n) + lambda := computePhi(p, q) + return &PrivateKey{ PublicKey: PublicKey{ N: n, - G: g, }, Lambda: lambda, - Mu: mu, } } diff --git a/paillier_test.go b/paillier_test.go index 6eddacb..5e9fe9b 100644 --- a/paillier_test.go +++ b/paillier_test.go @@ -7,46 +7,42 @@ import ( "testing" ) -func TestLCM(t *testing.T) { - a := big.NewInt(1350) - b := big.NewInt(141075) - expected := big.NewInt(282150) - - if !reflect.DeepEqual(expected, LCM(a, b)) { - t.Fail() - } -} - -func TestL(t *testing.T) { +func TestComputeL(t *testing.T) { u := big.NewInt(21) n := big.NewInt(3) - exp := big.NewInt(6) - if !reflect.DeepEqual(exp, L(u, n)) { - t.Error("L function is not good") + + expected := big.NewInt(6) + actual := L(u, n) + + if !reflect.DeepEqual(expected, actual) { + t.Errorf("Unexpected L function result [%v]", actual) } } -func TestComputeMu(t *testing.T) { - p := big.NewInt(13) - q := big.NewInt(11) - - lambda := computeLamda(p, q) - g := big.NewInt(5000) - n := new(big.Int).Mul(p, q) - - exp := big.NewInt(3) - if !reflect.DeepEqual(computeMu(g, lambda, n), exp) { - t.Error("mu is not well computed") - } -} - -func TestComputeLambda(t *testing.T) { +func TestComputePhi(t *testing.T) { a := big.NewInt(5) b := big.NewInt(7) - expected := big.NewInt(12) - if !reflect.DeepEqual(expected, computeLamda(a, b)) { - t.Error("lambda is not correctly computed") + expected := big.NewInt(24) + actual := computePhi(a, b) + + if !reflect.DeepEqual(expected, actual) { + t.Errorf("Unexpected phi value [%v]", actual) + } +} + +func TestCreatePrivateKey(t *testing.T) { + p := big.NewInt(463) + q := big.NewInt(631) + + privateKey := CreatePrivateKey(p, q) + + if !reflect.DeepEqual(privateKey.N, big.NewInt(292153)) { + t.Errorf("Unexpected N PublicKey value [%v]", privateKey.N) + } + + if !reflect.DeepEqual(privateKey.Lambda, big.NewInt(291060)) { + t.Errorf("Unexpected Lambda Public key value [%v]", privateKey.Lambda) } } @@ -63,10 +59,9 @@ func TestEncryptDecryptSmall(t *testing.T) { } returnedValue := privateKey.Decrypt(cypher) if !reflect.DeepEqual(inicialValue, returnedValue) { - t.Error("wrond decryption ", returnedValue, " is not ", inicialValue) + t.Error("wrong decryption ", returnedValue, " is not ", inicialValue) } } - } func TestAddCypher(t *testing.T) { From 69c60e90d5c08328dcb08ffee1477244fbe4a24e Mon Sep 17 00:00:00 2001 From: Piotr Dyraga Date: Thu, 24 May 2018 19:02:01 +0200 Subject: [PATCH 4/7] Do not cache N^2 value in PublicKey Let's keep this structure clean. Computing N^2 is just a really small piece of encryption/decryption work and if we decide we need to tweak performance, we will need a different approach anyway. --- encoding_test.go | 2 +- paillier.go | 7 +------ 2 files changed, 2 insertions(+), 7 deletions(-) diff --git a/encoding_test.go b/encoding_test.go index 660a5e2..1bb9a1c 100644 --- a/encoding_test.go +++ b/encoding_test.go @@ -118,6 +118,6 @@ func TestPartialDecryptionZKPBSONification(t *testing.T) { } func TestThresholdKeyBSON(t *testing.T) { - key := &ThresholdKey{PublicKey{b(9), b(8), nil}, 7, 6, b(3), []*big.Int{b(2), b(34)}} + key := &ThresholdKey{PublicKey{b(9), b(8)}, 7, 6, b(3), []*big.Int{b(2), b(34)}} AssertBSONIsGood(key, new(ThresholdKey), t) } diff --git a/paillier.go b/paillier.go index 134a0f4..df22c7d 100644 --- a/paillier.go +++ b/paillier.go @@ -8,7 +8,6 @@ import ( type PublicKey struct { N, G *big.Int // usually G is set to N+1 - n2 *big.Int // the cache value of N^2 } func (this *PublicKey) GetBSON() (interface{}, error) { @@ -19,11 +18,7 @@ func (this *PublicKey) GetBSON() (interface{}, error) { } func (this *PublicKey) GetNSquare() *big.Int { - if this.n2 != nil { - return this.n2 - } - this.n2 = new(big.Int).Mul(this.N, this.N) - return this.n2 + return new(big.Int).Mul(this.N, this.N) } // Encode a plaintext in a cypher one. The plain text must be smaller that From 4595f69872464cee443ccb32f8c6420cb3918746 Mon Sep 17 00:00:00 2001 From: Piotr Dyraga Date: Thu, 24 May 2018 19:13:29 +0200 Subject: [PATCH 5/7] G parameter moved from PublicKey to ThresholdKey We don't need G for our PublicKey since it's now always equal N+1. It's required by the `ThresholdKey` to compile, so I moved it there. I will investigate if for a threshold Paillier scheme G is really needed in the pkey. --- encoding_test.go | 2 +- paillier.go | 6 ++---- thresholdkey.go | 1 + 3 files changed, 4 insertions(+), 5 deletions(-) diff --git a/encoding_test.go b/encoding_test.go index 1bb9a1c..9e0e945 100644 --- a/encoding_test.go +++ b/encoding_test.go @@ -118,6 +118,6 @@ func TestPartialDecryptionZKPBSONification(t *testing.T) { } func TestThresholdKeyBSON(t *testing.T) { - key := &ThresholdKey{PublicKey{b(9), b(8)}, 7, 6, b(3), []*big.Int{b(2), b(34)}} + key := &ThresholdKey{PublicKey{b(9)}, 7, 6, b(3), []*big.Int{b(2), b(34)}, b(8)} AssertBSONIsGood(key, new(ThresholdKey), t) } diff --git a/paillier.go b/paillier.go index df22c7d..74dbd8d 100644 --- a/paillier.go +++ b/paillier.go @@ -7,12 +7,11 @@ import ( ) type PublicKey struct { - N, G *big.Int // usually G is set to N+1 + N *big.Int // usually G is set to N+1 } func (this *PublicKey) GetBSON() (interface{}, error) { m := make(map[string]string) - m["g"] = fmt.Sprintf("%x", this.G) m["n"] = fmt.Sprintf("%x", this.N) return m, nil } @@ -57,8 +56,7 @@ type PrivateKey struct { } func (this *PrivateKey) String() string { - ret := fmt.Sprintf("g : %x", this.G) - ret += fmt.Sprintf("n : %x", this.N) + ret := fmt.Sprintf("n : %x", this.N) ret += fmt.Sprintf("lambda: %x", this.Lambda) return ret } diff --git a/thresholdkey.go b/thresholdkey.go index 30b966d..c76bb6c 100644 --- a/thresholdkey.go +++ b/thresholdkey.go @@ -14,6 +14,7 @@ type ThresholdKey struct { Threshold int V *big.Int Vi []*big.Int + G *big.Int } // returns the value of (4*delta**2)** -1 mod n From 013296b8e4ac9d2dc8742179aa0b15398d984751 Mon Sep 17 00:00:00 2001 From: Piotr Dyraga Date: Thu, 24 May 2018 19:15:48 +0200 Subject: [PATCH 6/7] Removed PrivateKey's String() method It's better to have no code encouraging to turn key into a string and printing it somewhere, especially that string contains private key Lambda parameter. --- paillier.go | 6 ------ 1 file changed, 6 deletions(-) diff --git a/paillier.go b/paillier.go index 74dbd8d..fc501e5 100644 --- a/paillier.go +++ b/paillier.go @@ -55,12 +55,6 @@ type PrivateKey struct { Lambda *big.Int } -func (this *PrivateKey) String() string { - ret := fmt.Sprintf("n : %x", this.N) - ret += fmt.Sprintf("lambda: %x", this.Lambda) - return ret -} - // Decodes ciphertext into a plaintext message. // // c - cyphertext to decrypt From 9fe64ff57bd1a20b75d3f4271129297e3a86d81b Mon Sep 17 00:00:00 2001 From: Piotr Dyraga Date: Fri, 25 May 2018 09:58:26 +0200 Subject: [PATCH 7/7] Comment about G value moved to ThresholdKey G is no longer a parameter of PublicKey. --- paillier.go | 2 +- thresholdkey.go | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/paillier.go b/paillier.go index fc501e5..9a2ab6c 100644 --- a/paillier.go +++ b/paillier.go @@ -7,7 +7,7 @@ import ( ) type PublicKey struct { - N *big.Int // usually G is set to N+1 + N *big.Int } func (this *PublicKey) GetBSON() (interface{}, error) { diff --git a/thresholdkey.go b/thresholdkey.go index c76bb6c..3ade718 100644 --- a/thresholdkey.go +++ b/thresholdkey.go @@ -14,7 +14,7 @@ type ThresholdKey struct { Threshold int V *big.Int Vi []*big.Int - G *big.Int + G *big.Int // usually G is set to N+1 } // returns the value of (4*delta**2)** -1 mod n