Function `EncryptWithR` lets to specify randomness `r` explicitely. For
some ZKPs based on the Paillier scheme, it's required to use the same
`r` for encryption and constructing ZKP. It wasn't possible previously,
because `r` was generated internally and never returned.
I did not want to modify `Encrypt` to return `r` because it would break
existing code using this API, as well as, I want to make sure person
using the specific `r` and using it somewhere else really knows what
he's doing.
`PublicKey.Add` accepts now an arbitrary number of `*Cypher`s.
Previously, it was possible to add only two `*Cypher*` instances and it
was quite unwieldy for a lot of use cases.
The current implementation is backward compatible. It's still possible
to pass just two `*Cypher` arguments, so every project referencing the
library will observe no compilation issues.
It's better to have no code encouraging to turn key into a string and printing it somewhere, especially that string contains private key Lambda parameter.
We don't need G for our PublicKey since it's now always equal N+1. It's required by the `ThresholdKey` to compile, so I moved it there. I will investigate if for a threshold Paillier scheme G is really needed in the pkey.
Let's keep this structure clean. Computing N^2 is just a really small piece of encryption/decryption work and if we decide we need to tweak performance, we will need a different approach anyway.
The code for generating private key is based on approach described in [KL 08], construction 11.32 which is compatible with the one described in [DJN 10], section 3.2 except that instead of generating Lamda private key compontent from LCM of `p` and `q` we use Euler's totient function as suggested in [KL 08]. I cleared up naming as well as removed G and Mu parameters from Paillier key. For the modification of Paillier scheme we use, where g = n + 1, N is the only one parameter needed for a public key. Also, Mu is needed only for Decrypting and can be computed there from Lambda and N so there is no need to keep it in the private key.
I added documentation to <Key, Enc, Dec> functions with an important note that `p` and `q` supplied to `CreatePrivateKey` must be either of equal length or `gcd(pq, (p-1)(q-1)) = 1` which is assured if both primes are of equal length. This requirement is mentioned both in [KL 08] and [DJN 10].
[KL 08]: Jonathan Katz, Yehuda Lindell, (2008)
Introduction to Modern Cryptography: Principles and Protocols,
Chapman & Hall/CRC
[DJN 10]: Ivan Damgard, Mads Jurik, Jesper Buus Nielsen, (2010)
A Generalization of Paillier’s Public-Key System
with Applications to Electronic Voting
Aarhus University, Dept. of Computer Science, BRICS
Piotr Dyraga