DCR ⇒ TPKE

Free reduction · random oracle model · FPS00, DJ01

Statement

In threshold Paillier, a trusted dealer generates a Paillier key and Shamir-shares its decryption exponent among the servers; each server publishes a partial decryption with a non-interactive proof that it is correct, and enough partial decryptions combine to the plaintext. Under DCR and in the random oracle model, this threshold encryption scheme is IND-CPA secure against an active, static adversary corrupting fewer than the threshold number of servers — FPS00. DJ01 give a threshold variant, also with a trusted dealer, of their generalisation modulo $n^{s+1}$.