Only Additive Homomorphic Enc/Dec using she namespace

[eNipu]

I would like to use mcl for calculating additive holomorphic encryption(lifted ElGamal) over the G_1 group only. Is it possible?

I found that there is a flag named isG1only_ and initG1only method. I thought that the library can be used without using pairing groups G2 and GT. Is my thought correct?

1. Is the test code of the CYBOZU_TEST_AUTO(liftedElGamal) function can be used as an example for this purpose?
2. If I add the public parameters of Curve25519 in mcl::ecparam, will it work?

Thank you.

[herumi]

thought that the library can be used without using pairing groups G2 and GT. Is my thought correct?

Yes.

Is the test code of the CYBOZU_TEST_AUTO(liftedElGamal) function can be used as an example for this purpose?

Yes.

If I add the public parameters of Curve25519 in mcl::ecparam, will it work?

No. The Curve25519 type is different from the Weierstrass function, so the current mcl does not support the curve.

[eNipu]

@herumi Thank you for your reply.

I've two more questions.

If I understood correctly, then there are two ways to achieve additive-homomorphism in mcl. One is using the API's in elgmal.hpp and another is using namespace mcl::she for G1 group only. ElgamalT uses curve on the prime field. mcl::she can take both pairing-friendly curves and prime field curves.

1. For encryption and decryption speed, is it better to use ElgamalT over mcl::she for the G_1 group only?
2. If the plaintext integer is > 2^32 then what is your suggestion to speed up the ElGamal decryption?

[herumi]

1. she.hpp is newer than elgamal.hpp, so she.hpp is faster decryption.
2. she::init(curve, hashSize, tryNum) where hashSize and tryNum affect decryption time.

It requires hashSize * 4-byte table for decryption and increases initializing time. see https://github.com/herumi/mcl/blob/master/misc/she/she-api.md#global-functions

[eNipu]

@herumi Thank you! I tried both mcl::ElgamalT and mcl::she for the enc and decryption. It seems that the mcl::she is faster for decryption but mcl::ElgamalT is about 5 times faster for encryption. This probably because I was using secp160k1 has a smaller prime modulus than the BN curve.

1. Is it possible to use the prime order curve defined in EcParam with she.hpp when G_1 only group is used?
2. she.hpp has a python binding file. I'm thinking to write a similar binding for elgamal.hpp. If you have any suggestions for any particular binding library please let me know.

[herumi]

but mcl::ElgamalT is about 5 times faster for encryption.

PrecomputedPublicKey is a little faster than ElgamalT.

https://github.com/herumi/mcl/blob/master/sample/she_g1only.cpp

make bin/she_g1only.exe && bin/she_g1only.exe
pub.enc 188.295Kclk
ppub.enc  48.435Kclk
Dec(Enc(123) + Enc(654)) = 777(ok)
elgamal
dec=777
enc  57.724Kclk

[eNipu]

@herumi Thank you. I am closing this issue.