homomorphic encryption

[SagiIsumi]

I have a problem with the additive homomorphic encryption in EC-Elgamal encryption.
I am new to this field and not sure how to properly implement an additive homomorphic encryption.
Here is my code, which is adopted from elgamal demo.

async def crypt_cycle(secgrp, M, public_out=True):
"""Encrypt/decrypt cycle for message M."""
group = secgrp.group
# Create ElGamal key pair:
g = group.generator
x, val, h = await keygen(g)

# Party 0 encrypts message M and broadcasts ciphertext C:
if mpc.pid == 0:
    M, Z = group.encode(M)
    C_M = encrypt(g, h, M)
    C_Z = encrypt(g, h, Z)
    print(f"M is {M}.")
    print(f"M + M is {group.operation(M, M)}.")
    print(C_M[0])
    C_sum_M = (
        group.operation(C_M[0], C_M[0]),
        group.operation(C_M[1], C_M[1]),
    )

    C_sum_Z = (
        group.operation(C_Z[0], C_Z[0]),
        group.operation(C_Z[1], C_Z[1]),
    )
    print(C_sum_M[0])
    C = [C_sum_M, C_sum_Z]
else:
    C = None
C = await mpc.transfer(C, senders=0)

# Threshold decrypt C:
C_M, C_Z = C
M = await decrypt(C_M, x, public_out=public_out)
Z = await decrypt(C_Z, x, public_out=public_out)
print(f"decrypt M is {M}.")
if public_out:
    M = group.decode(M, Z)
else:
    M = secgrp.decode(M, Z)
return M

The output is :
M is (257, 53823712452320363895824390343237180151116088985480775814302064026231944310978, 1).
M + M is (79582128359897012132046732129385632174207216946049178555026236477095119340954, 288139183958277, 25381427886521194715786833111758428906636869328910492589754428560014449477955).
(55248720524076708393249538408505906349466379989908296519098908590880997361068, 65417561557286790000894829659234252288889963663613593469208016348890688584169, 39648537797747291579915591800900055732251757610293627218162436765690692255607)
(79002969319555479328893882949935608517562099037866010818920027175467394315558, 6993212554695906705827395900863885119913760650640566136379216931568818679438, 34909080237015040578991785882238430306444361123300999639496511336671147302873)
decrypt M is (49242497037307959134382287928711943602302881048462081919276719518537201413911, 101281787172268571767425060506932246092409227287947154914137095385622943306089, 11417557564405359019800601285211459175809879914463955999070220286005165155402).
Plaintext received: 15221582882309125410898689585122491243024517310635171139981289439105922820511

[lschoe]

The code you've modified above is using encoding and decoding mappings in combination with ElGamal, but these mappings are not (meant to be) homomorphic.

To get started it's better to look at another piece of code in the same demo. Namely, the function election(), which demonstrates the well-known CGS97 election scheme in the passive case:

mpyc/demos/elgamal.py

Lines 79 to 103 in 98ac889

	async def election(secgrp):
	"""Boardroom election between all MPC parties."""
	group = secgrp.group
	# Create ElGamal key pair:
	g = group.generator
	x, h = await keygen(g)
	# Each party encrypts a random vote:
	v = random.randint(0, 1)
	print(f'''My vote: {v} (for {'"yes"' if v else '"no"'})''')
	c = encrypt(g, h, g^v) # additive homomorphic ElGamal
	c = await mpc.transfer(c)
	# Accumulate all votes:
	C = list(c[0])
	for c_i in c[1:]:
	C[0] @= c_i[0]
	C[1] @= c_i[1]
	# Decrypt using MPC:
	M = await decrypt(C, x, public_out=True)
	T, t = group.identity, 0 # T = g^t
	while T != M:
	T, t = T @ g, t+1
	print(f'Referendum result: {t} "yes" / {len(c) - t} "no"')

The ElGamal encryptions are made additively homomorphic by using $g^v$ to represent a yes/no vote $v\in\{0,1\}$.