---
title: Paillier Homomorphic Encryption
url: https://www.emergentmind.com/topics/paillier-homomorphic-encryption
type: topic
---

# Paillier Homomorphic Encryption

Paillier homomorphic encryption is a seminal public-key cryptosystem based on composite residuosity and is notable for its additive homomorphic property. This allows for efficient arithmetic directly on ciphertexts, enabling privacy-preserving computations such as secure aggregation, biometric matching, and secret sharing. Designed in 1999, the Paillier scheme has become a foundational primitive for a range of cryptographic protocols and primitives, including secure multiparty computation, threshold cryptography, blind signatures, and homomorphic secret sharing.

## 1. Mathematical Construction and Cryptographic Primitives

The Paillier cryptosystem operates over the group of invertible elements modulo $n^2$, where $n = pq$ for large primes $p, q$ [1511.05787][1206.1078][1704.03578][1803.03559][2503.05850][2410.06514][2007.10560]. Key generation, encryption, and decryption procedures are as follows:

- **Key Generation**
  1. Select large primes $p, q$ (typically 1024–2048 bits for security).
  2. Compute modulus $n = p \cdot q$, and $\lambda = \mathrm{lcm}(p-1, q-1)$.
  3. Choose generator $g \in \mathbb{Z}_{n^2}^*$ such that $\gcd(L(g^\lambda \bmod n^2), n) = 1$, where $L(u) = (u-1)/n$.
  4. Compute $\mu = (L(g^\lambda \bmod n^2))^{-1} \bmod n$.
  5. Public key: $(n, g)$; private key: $(\lambda, \mu)$.

- **Encryption**
  - Plaintext $m \in \mathbb{Z}_n$, random $r \in \mathbb{Z}_n^*$.
  - Ciphertext: $c = g^m \cdot r^n \bmod n^2$.

- **Decryption**
  - Compute $u = c^\lambda \bmod n^2$.
  - Recover $m = L(u) \cdot \mu \bmod n$.

These steps are consistent across academic presentations, implementations, and engineering optimizations [1704.03578][2007.10560][2503.05850].

## 2. Additive Homomorphism and Algebraic Laws

Paillier’s critical property is its support for homomorphic addition:

- **Additive Homomorphism**: For ciphertexts $c_1 = E(m_1; r_1)$, $c_2 = E(m_2; r_2)$,
  $$
  c_1 \cdot c_2 \bmod n^2 = E(m_1 + m_2; r_1 r_2)
  $$
  This enables the sum of plaintexts to be evaluated by multiplying ciphertexts [1511.05787][1704.03578][1206.1078].

- **Scalar Multiplication**: Raising a ciphertext to integer $k$ yields
  $$
  E(m; r)^k = E(k \cdot m; r^k)
  $$
  Supporting linear aggregate operations and enabling implementations such as encrypted dot products, as in privacy-preserving vector similarity computations [2503.05850][1803.03559].

- These properties require only group operations modulo $n^2$ and exponentiations, making the scheme attractive for secure arithmetic over encrypted data.

## 3. Security Foundations and Complexity Assumptions

The scheme’s security relies on the composite residuosity problems:

- **Decisional Composite Residuosity Assumption (DCR):** Given $(n, z \in \mathbb{Z}_{n^2}^*)$, it is hard to decide whether $z$ is an $n$-residue, i.e., $z = y^n \bmod n^2$ for some $y$ [1511.05787][1704.03578][1206.1078].
- **Computational Composite Residuosity Assumption (CCRA):** It is hard to compute $m$ in $w \equiv g^m y^n \bmod n^2$ without the private key.

Semantic security (IND-CPA) is equivalent to the DCR assumption [1511.05787]. The message randomness $r$ ensures that identical plaintexts yield independent ciphertexts (self-blinding), enforcing unlinkability [1803.03559].

## 4. Practical Applications and Performance Considerations

Paillier HE is used extensively in privacy-preserving computational settings, due to its balance of efficiency, small key sizes, and exact computation [2503.05850][2007.10560][1803.03559][2410.06514]. Empirical evidence indicates:

- **Vector Similarity Search**: Used for facial recognition and recommendation over encrypted embeddings; achieves negligible accuracy loss ($\approx10^{-14}$ to $10^{-7}$), moderate throughput (e.g., encryption $\approx0.4$–$1.7$it/s at 80–112 bits, 128–4096D) with sub-MB key/ciphertext sizes [2503.05850].
- **Federated Learning**: Hardware-accelerated Paillier can reduce encryption time per iteration by up to $71\%$ and overall iteration time by $26\%$ in federated learning systems, outperforming CPU-based software by an order of magnitude [2007.10560].
- **Biometric Template Protection**: Encrypted cosine and Euclidean similarity with Paillier HE preserves classifier performance while offering unlinkability and irreversibility (meeting ISO/IEC 24745 for biometric security) [1803.03559].
- **Homomorphic Secret Sharing (HSS)**: FastPaillier-based HSS such as MORSE supports linear and nonlinear computation, reducing communication costs by $16.6\%$ and offering up to $9.3\times$ speedup in secure multiplication compared to prior Paillier-based HSS [2410.06514].

| Security Level         | Key Size    | Embedding Size     | Enc. Throughput (128D) | Hom. Throughput (128D) | Loss         |
|-----------------------|-------------|--------------------|------------------------|------------------------|--------------|
| 80 bits (1024 bit mod)| 0.0015 MB   | 0.1308 MB (128D)   | 1.66 it/s              | 8.07 it/s              | $10^{-14}$   |
| 112 bits (2048 bit)   | 0.003 MB    | 0.2559 MB (128D)   | 0.40 it/s              | 2.41 it/s              | $10^{-14}$   |

Paillier’s small key and ciphertext sizes make it preferable for memory-constrained environments such as mobile and edge computing.

## 5. Protocol Adaptations and Cryptographic Extensions

Paillier's structure supports several higher-level protocols and variants:

- **Blind Signatures**: Paillier naturally yields a trapdoor permutation, enabling blind signatures and one-wayness [1511.05787][1206.1078].
- **Three-Pass Protocol**: The addition law enables a “no-key” three-pass protocol where only the sender requires the private key; operation is based on Paillier's homomorphism rather than commutativity [1206.1078].
- **BCP Double Trapdoor Variant**: The Bresson–Catalano–Pointcheval scheme introduces independent trapdoors for recovering the randomness and the message, enabling robust threshold decryption and key splitting for cloud applications [1511.05787]. The decryption shares are mutually independent and facilitate distributed or verifiable computation.
- **Homomorphic Secret Sharing**: Protocols such as MORSE leverage Paillier additive homomorphism and efficient share–ciphertext conversion to support a full suite of arithmetic, including non-linear functions, with concrete speedups and reduced bandwidth [2410.06514].
- **Extensions**: Damgård–Jurik generalizes to $n^{k+1}$ modulus, Okamoto–Uchiyama modifies the modulus for efficiency, and elliptic-curve variants move the construction to new algebraic domains while preserving additive homomorphism [1511.05787][1704.03578].

## 6. Implementation and Hardware Acceleration

Efficient implementation of Paillier encryption is possible using modular exponentiation strategies (e.g., square-and-multiply), and modular multiplication is often optimized via Montgomery or Karatsuba methods [2007.10560]. FPGA workflows utilize pipelined, resource-optimized cores, achieving per-operation costs close to theoretical minimums and supporting parallelism for batch cryptographic workloads. Key practicalities include:

- Flexible core and batch sizing via OpenCL and HLS paradigms,
- Parallel encryption/decryption for federated learning,
- Clock frequencies in excess of $500$ MHz on contemporary FPGAs,
- BRAM partitioning to manage operand storage and in-flight data transfers.

## 7. Security Analysis, Trade-Offs, and Research Directions

Security of Paillier HE derives directly from the DCR and CCRA assumptions. Fresh ciphertexts for identical plaintexts, unlinkability, and exact algebraic computation are realizable under standard parameter choices. However, scalability challenges can arise: ciphertext and communication sizes grow linearly with vector dimension in ML applications, and decryption throughput may be a limiting factor in resource-limited scenarios [2503.05850]. FHE alternatives (e.g., CKKS via TenSEAL) enable multiplicative depth, but with multi-megabyte keys and non-negligible computation error; Paillier remains preferable when exact arithmetic and memory efficiency are critical [2503.05850][2410.06514].

Emergent research directions include further key size reductions, efficiency improvements (via variants like FastPaillier [2410.06514]), lightweight alternatives [2312.06987], and improved support for non-linear operations through cryptographic protocol adaptations.

---

**References**:  
[1206.1078], [1511.05787], [1704.03578], [2503.05850], [2410.06514], [2007.10560], [1803.03559], [2312.06987]

Source: https://www.emergentmind.com/topics/paillier-homomorphic-encryption