---
# System prepended metadata

title: Untitled

---

https://github.com/ZenGo-X/zk-paillier

zk-paillier proofs:
1. ciphertext is zero
   - https://github.com/ZenGo-X/zk-paillier/blob/master/src/zkproofs/zero_enc_proof.rs
   - From Damgard Jurik, https://www.brics.dk/RS/00/45/BRICS-RS-00-45.pdf
2. Knowledge of plaintext
   - https://github.com/ZenGo-X/zk-paillier/blob/master/src/zkproofs/correct_key_ni.rs
   - "Efficient Noninteractive Certificationof RSA Moduli and Beyond" https://eprint.iacr.org/2018/057.pdf
   - "Fast Secure Multiparty ECDSA with PracticalDistributed Key Generation and Applications toCryptocurrency Custody" https://eprint.iacr.org/2018/987.pdf
       6.2.3
3. gcd(N,phi(N)) = 1
   1. Interactive
      - https://github.cocm/ZenGo-X/zk-paillier/blob/master/src/zkproofs/correct_key.rs
      - section 3.1 in [Lindell'17](https://eprint.iacr.org/2017/552)
      - section 3.3 in [HMRTN'12](https://eprint.iacr.org/2011/494)
      - section 4.2 in [DJ'01](http://www.brics.dk/RS/00/45/BRICS-RS-00-45.pdf)
   2. Non-interactive
      - https://eprint.iacr.org/2018/057.pdf
      - for parameters = e = N, m2 = 11, alpha = 6370 see https://eprint.iacr.org/2018/987.pdf 6.2.3
4. Range proof, msg in [0,q]
   1. Interactive
      - https://github.com/ZenGo-X/zk-paillier/blob/master/src/zkproofs/range_proof.rs
      - Appendix A in [Lindell'17](https://eprint.iacr.org/2017/552)
      - Section 1.2.2 in [Boudot '00](https://www.iacr.org/archive/eurocrypt2000/1807/18070437-new.pdf)
      - Assumes only DCRA
   2. Non-interactive
      - https://github.com/ZenGo-X/zk-paillier/blob/master/src/zkproofs/range_proof_ni.rs
      - Same as 3.1, but with Fiat-Shamir.
5. Correct opening
   - https://github.com/ZenGo-X/zk-paillier/blob/master/src/zkproofs/correct_opening.rs
   - This is just checking trivially that ct = ENC(m,r).
6. Correct message
   - https://github.com/ZenGo-X/zk-paillier/blob/master/src/zkproofs/correct_message.rs
   - In the case that the message space size is small (a message can be only one of a few possibilities), it is possible to create a "ring" like structure that proves that the encrypted value is a message from the message space without revealing the message.
   - https://paillier.daylightingsociety.org/Paillier_Zero_Knowledge_Proof.pdf
7. + a few more proofs less relevant
