zengo-x / rust-paillier

A pure-Rust implementation of the Paillier encryption scheme

Paillier

Efficient pure-Rust library for the Paillier partially homomorphic encryption scheme, offering also packed encoding for encrypting several values together as well as several zero-knowledge proofs related to typical use-cases. Supports several underlying arbitrary precision libraries: GMP and num-bigint.

Several companies have invested resources in the development of this library, including Snips who implemented the original version for use in their privacy-preserving analytics system, and KZen networks who contributed with implementations of many zero-knowledge proofs. See contributions below for more details.

Important: while we have followed recommendations regarding the scheme itself, some parts of this library have not yet been hardened against non-cryptographic attacks such as side-channel attacks.

extern crate paillier;
use paillier::*;

fn main() {

  // generate a fresh keypair and extract encryption and decryption keys
  let (ek, dk) = Paillier::keypair().keys();

  // encrypt four values
  let c1 = Paillier::encrypt(&ek, 10);
  let c2 = Paillier::encrypt(&ek, 20);
  let c3 = Paillier::encrypt(&ek, 30);
  let c4 = Paillier::encrypt(&ek, 40);

  // add all of them together
  let c = Paillier::add(&ek,
    &Paillier::add(&ek, &c1, &c2),
    &Paillier::add(&ek, &c3, &c4)
  );

  // multiply the sum by 2
  let d = Paillier::mul(&ek, &c, 2);

  // decrypt final result
  let m: u64 = Paillier::decrypt(&dk, &d);
  println!("decrypted total sum is {}", m);

}

Installation

[dependencies.paillier]
package = "kzen-paillier"
version = "0.2"

Underlying arithmetic

The choice of underlying arithmetic library may be changed using features curv/rust-gmp-kzen (default) and curv/num-bigint. GMP generally offers better performance, but requires GMP shared library to be installed on the system. nim-bigint is pure Rust implementation of big integer and doesn't require any external dependencies.

Only performance is affected by choosing one of arithmetic implementation. All functionality remains the same.

In order to build on num-bigint instead, put into Cargo.toml:

[dependencies.paillier]
package = "kzen-paillier"
version = "0.2"
default-features = false
features = ["curv/num-bigint"]

Usage

Key generation

Key generation feature keygen is included by default but if unneeded may safely be excluded to avoid extra dependencies.

extern crate paillier;
use paillier::*;

fn main() {

  // generate a fresh keypair and extract encryption and decryption keys
  let (ek, dk) = Paillier::keypair().keys();

  ...

}

Benchmarks

Several benches are included, testing both the underlying arithmetic libraries as well as the operations of the scheme. All may be run using

cargo bench

and including either several arithmetic libraries and key generation as discussed above.

License

Forked from snipsco/rust-paillier with additional functionality. Licensed under either of

• Apache License, Version 2.0 (LICENSE-APACHE or http://www.apache.org/licenses/LICENSE-2.0)
• MIT license (LICENSE-MIT or http://opensource.org/licenses/MIT)

at your option.

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.

Contributions

Several people have had a significant impact in the development of this library (in alphabetical order):

• Gary Benattar (KZen networks)
• Mario Cornejo (while at Snips)
• Mathieu Poumeyrol (Snips)
• Omer Shlomovits (KZen networks)

and several companies have invested resources:

• Snips sponsored implementation of the original version
• KZen networks sponsored extension of many zero-knowledge proofs

Reported uses

• Snips: privacy-preserving analytics
• KZen networks: multi-party signatures

rust-paillier's Issues

Serialization for BigInts is redefined to be in base 10 instead of 16

I noticed that the crate redefines serialization of curv::BigInts to be in base 10, e.g.,

for KeyPair, p and q are going to be in base 10

rust-paillier/src/lib.rs

Lines 23 to 29 in 7d4958f

	pub struct Keypair {
	#[serde(with = "crate::serialize::bigint")]
	pub p: BigInt, // TODO[Morten] okay to make non-public?
	#[serde(with = "crate::serialize::bigint")]
	pub q: BigInt, // TODO[Morten] okay to make non-public?
	}

because

rust-paillier/src/serialize.rs

Lines 9 to 11 in 7d4958f

	pub fn serialize<S: ser::Serializer>(x: &BigInt, serializer: S) -> Result<S::Ok, S::Error> {
	serializer.serialize_str(&x.to_str_radix(10))
	}

while in the curv crate BigInts are serialized using base 16

https://github.com/ZenGo-X/curv/blob/78cac40a47e145eb845d687cc748f9312d999db9/src/arithmetic/serde_support.rs#L9-L21

Imagine a server defines a struct as such

#[derive(Serialize, Deserialize)]
struct S {
  b: curv::BigInt,
  ek: EncryptionKey
 } 

then a third-party app needs to selectively serialize BigInts of the corresponding fields.

What was the reason behind that?

BigInt type problem (curv and rust-paillier)

Hi, I encountered a type conversion issue among type BigInt:

1. Using Paillier::encrypt in rust-paillier, we need to first convert the BigInt variable to RawPlaintext. However, there is an error:

error[E0277]: the trait bound `RawPlaintext<'_>: From<&curv::BigInt>` is not satisfied
   --> ...
    |
63  |         RawPlaintext::from(&x1)
    |         ^^^^^^^^^^^^^^^^^^ the trait `From<&curv::BigInt>` is not implemented for `RawPlaintext<'_>`

2. Using Paillier::decrypt in rust-paillier:

    let gamma1 = Paillier::decrypt(
        &dk,
        RawCiphertext::from(C_gamma.clone())
    ).0
    .clone()
    .into_owned();

and gamma1 is a paillier::Bigint rather than a curv::BigInt.

I think it is the same origin of problem, would anyone can give me any suggestion?

Thank you!

Release crate on crates.io

As discussed in #13 this crate is ready to be released on crates.io.
Proposed name: kzen-pallier

Migrate to Non-fork Repo

To increase discoverability on GitHub it could be good to migrate the repository to a standalone repository so that it will pop up in GitHub searches. This seems to be much more recently updated and was able to find it through the lib.rs listing.

You have to contact GitHub support to have them migrate the repo: https://help.github.com/en/articles/why-are-my-contributions-not-showing-up-on-my-profile#commit-was-made-in-a-fork.

Is this crate released on crates.io ?

Hello, just a quick question:
Is this fork released on crates.io? On first glance it seems to be maintained, in contrast to the repository it was forked from, but paillier = 2.0 seems to be the original implementation on crates.io (https://crates.io/crates/paillier).
I'm aware that it is possible add git dependencies, but if there was a crates.io version and I just couldn't find that, I would prefer that :)

Missing checks on membership of r in multiplicative group

This issue refers to

rust-paillier/src/core.rs

Line 325 in 57fc04d

let r = BigInt::sample_below(&ek.n);

Ideally, the r chosen here should be coprime to N in general Paillier scheme. The sampling here does not check if this is true.

There are other places using sample_below without this check.

There are two ways to address this issue. One is to check if r is coprime to N every time. Or we need to ensure that when decrypting the ballots we reject 0 and restart the protocol.

cc @dingxiangfei2009

fix links to paillier paper

https://github.com/ZenGo-X/rust-paillier/blob/master/src/core.rs#L334