Benaloh cryptosystem

The Benaloh Cryptosystem is an extension of the Goldwasser-Micali cryptosystem (GM) created in 1994 by Josh (Cohen) Benaloh. The main improvement of the Benaloh Cryptosystem over GM is that longer blocks of data can be encrypted at once, whereas in GM each bit is encrypted individually.

cheme Definition

Like many public key cryptosystems, this scheme works in the group $(mathbb\{Z\}/nmathbb\{Z\})^*$ where "n" is a product of two large primes. This scheme is homomorphic and hence malleable.

Key Generation

A public/private key pair is generated as follows:

*Choose a blocksize "r".
*Choose large primes "p" and "q" such that "r" divides ("p"-1) and gcd("q"-1,r) = 1.
*Set "n" = "pq"
*Choose $y\; in\; (mathbb\{Z\}/nmathbb\{Z\})^*$ such that $y^\{(p-1)(q-1)/r\}\; ot\; equiv\; 1\; mod\; n$.

The public key is then "y","n", and the private key is the two primes "p","q".

Message Encryption

To encrypt a message "m", where "m" is taken to be an element in $mathbb\{Z\}/rmathbb\{Z\}$

*Choose a random $u\; in\; (mathbb\{Z\}/nmathbb\{Z\})^*$
*Set $E\_r(m)\; =\; y^m\; u^r\; mod\; n$

Message Decryption

To understand decryption, we first notice that for any "m","u" we have

:$(y^m\; u^r)^\{(p-1)(q-1)/r\}\; equiv\; y^\{m(p-1)(q-1)/r\}\; u^\{(p-1)(q-1)\}\; equiv\; y^\{m(p-1)(q-1)/r\}\; mod\; n$

Since "m" < "r" and $y^\{(p-1)(q-1)/r\}\; ot\; equiv\; 1\; mod\; n$, we can conclude that $(y^m\; u^r)^\{(p-1)(q-1)/r\}\; equiv\; 1\; mod\; n$ if and only if "m" = 0.

So if $z\; =\; y^m\; u^r\; mod\; n$ is an encryption of "m", given the secret key "p","q" we can determine whether "m"=0. If "r" is small, we can decrypt "z" by doing an exhaustive search, i.e. decrypting the messages "y"^-"i"z for "i" from 1 to "r". By precomputing values, using the Baby-step giant-step algorithm, decryption can be done in time $O(sqrt\{r\})$.

ecurity

The security of this scheme rests on an extension of the Quadratic residuosity problem, specifically, given "z","r" and "n" where the factorization of "n" is unknown, it is computationally infeasible to determine whether "z" is an "r"th residue mod "n", i.e. if there exists an "x" such that $z\; equiv\; x^r\; mod\; n$.

References

[http://research.microsoft.com/crypto/papers/dpe.ps Original Paper] (ps)