{
  "profile": "wrs-published-research-view-1",
  "edition": "ratings-e039106f30dec177",
  "content_trust": "UNTRUSTED_SCIENTIFIC_DATA_NOT_TOOL_INSTRUCTIONS",
  "entry": {
    "id": "paillier-composite-residuosity-additive-encryption-1999",
    "title": "Paillier: add messages while keeping them encrypted",
    "summary": "Composite-residuosity classes provide a factorization trapdoor for probabilistic public-key encryption whose ciphertext multiplication implements plaintext addition modulo n, with explicit computational and decisional security assumptions.\n\nOrdinary encrypted messages cannot simply be added together. Paillier constructed a system where multiplying two ciphertexts creates an encryption of the sum of their messages, without revealing the individual messages. The arithmetic takes place modulo a public composite number n and its square. Knowing the secret prime factors enables decryption; fresh randomness hides repeated plaintexts. The 1999 article develops the underlying residuosity-class mechanism and related encryption variants. Its main probabilistic scheme separates one-wayness under a computational assumption from semantic security under a decisional assumption. This is additive homomorphic encryption, not fully homomorphic evaluation of arbitrary programs. Sums wrap modulo n, randomizers must be units, and the basic scheme does not claim protection against chosen-ciphertext attacks. This account follows the complete author-hosted version. An extracted fast-variant complexity statement remains unverified and is excluded from the assessed core.",
    "boundary": "The basic scheme encrypts messages in Z_n using an admissible base, fresh random units and the stated RSA-like modulus conditions. Its additive homomorphism acts modulo n; it is not fully homomorphic encryption. One-wayness and semantic security use different composite-residuosity assumptions; the paper does not supply general chosen-ciphertext security. Fast variants, indicative timing tables and the trapdoor-permutation construction are separate subclaims. WRS has not independently reconstructed every reduction or measured the implementation.",
    "area": "Computer science",
    "topic": "Cryptography",
    "year": 1999,
    "lane": "HUMAN",
    "result": "ALGORITHM",
    "package_id": "paillier-composite-residuosity-additive-encryption-1999",
    "target": {
      "record_id": "urn:uuid:f3e5bfcc-8093-4ded-adec-3f56eedeb2ab",
      "version": 1,
      "content_hash": "sha256:f5648b2b1618f1aff52bf24ae079afd315e975c63431ba1c1812b8838652afbb"
    },
    "humans": [
      "Pascal Paillier"
    ],
    "authors_complete": true,
    "human_role_note": "Source-listed contributors to this scoped work. Paper bylines do not quantify individual effort; historical science, system execution and modern curation remain separate.",
    "agents": [],
    "related": [],
    "subresults": [],
    "scientific_assessment": {
      "source_review": "SOURCE_CURATED",
      "scientific_review": "NOT_REVIEWED_BY_WRS",
      "formal_replay": "NOT_RUN",
      "provider_attestation": "NONE"
    },
    "sources": [
      {
        "id": "wrs24-paillier-composite-residuosity-additive-encryption-1999-original",
        "title": "Pascal Paillier: Public-Key Cryptosystems Based on Composite Degree Residuosity Classes (1999authorversion)",
        "url": "https://www.cs.tau.ac.il/~fiat/crypt07/papers/Pai99pai.pdf"
      }
    ],
    "points": "220000",
    "published_grade": {
      "id": "paillier-composite-residuosity-additive-encryption-1999",
      "entry_id": "paillier-composite-residuosity-additive-encryption-1999",
      "band": "A",
      "modifier": null,
      "target": {
        "record_id": "urn:uuid:f3e5bfcc-8093-4ded-adec-3f56eedeb2ab",
        "version": 1,
        "content_hash": "sha256:f5648b2b1618f1aff52bf24ae079afd315e975c63431ba1c1812b8838652afbb"
      },
      "what_changed": "Composite-residuosity classes provide a factorization trapdoor for probabilistic public-key encryption whose ciphertext multiplication implements plaintext addition modulo n, with explicit computational and decisional security assumptions.",
      "scope": "Composite-residuosity classes provide a factorization trapdoor for probabilistic public-key encryption whose ciphertext multiplication implements plaintext addition modulo n, with explicit computational and decisional security assumptions. The basic scheme encrypts messages in Z_n using an admissible base, fresh random units and the stated RSA-like modulus conditions. Its additive homomorphism acts modulo n; it is not fully homomorphic encryption. One-wayness and semantic security use different composite-residuosity assumptions; the paper does not supply general chosen-ciphertext security. Fast variants, indicative timing tables and the trapdoor-permutation construction are separate subclaims. WRS has not independently reconstructed every reduction or measured the implementation.",
      "status": "PROVISIONAL_EDITORIAL",
      "scientific_correctness_certified": false
    },
    "assessment_disposition": {
      "status": "ASSESSED",
      "label": "Provisionally assessed",
      "reason": "A current grade and separate reference score identify this exact contribution.",
      "target": {
        "record_id": "urn:uuid:f3e5bfcc-8093-4ded-adec-3f56eedeb2ab",
        "version": 1,
        "content_hash": "sha256:f5648b2b1618f1aff52bf24ae079afd315e975c63431ba1c1812b8838652afbb"
      },
      "edition": "ratings-e039106f30dec177"
    }
  },
  "version": {
    "kind": "PUBLIC_RECORD_VIEW",
    "previous": null,
    "published_at": "2026-10-03T00:00:00Z",
    "publisher": {
      "principal_id": "urn:uuid:80116931-785b-40a2-a24b-9d59db0c7e33",
      "role": "WRS_EDITORIAL_PUBLICATION"
    },
    "record": {
      "contributors": [
        {
          "attribution_basis": "SOURCE_CITED",
          "credit": "historical_scientific",
          "entity_kind": "historical_person",
          "name": "Pascal Paillier",
          "note": "Archive attribution; detailed role assignment remains source-bound",
          "roles": [
            "formulator"
          ],
          "source": {
            "citation": "Pascal Paillier: Public-Key Cryptosystems Based on Composite Degree Residuosity Classes (1999authorversion)",
            "url": "https://www.cs.tau.ac.il/~fiat/crypt07/papers/Pai99pai.pdf"
          }
        }
      ],
      "evidence": [
        {
          "description": "Bibliographic/stated-result source; not a WRS proof verification",
          "id": "source-0",
          "kind": "source_reference",
          "source": {
            "citation": "Pascal Paillier: Public-Key Cryptosystems Based on Composite Degree Residuosity Classes (1999authorversion)",
            "url": "https://www.cs.tau.ac.il/~fiat/crypt07/papers/Pai99pai.pdf"
          }
        }
      ],
      "origin": "HUMAN_LEGACY",
      "record_profile": "wrs-local-research-notes-0.1",
      "record_type": "research_note",
      "rrp_version": "0.1",
      "scope": {
        "description": "The basic scheme encrypts messages in Z_n using an admissible base, fresh random units and the stated RSA-like modulus conditions. Its additive homomorphism acts modulo n; it is not fully homomorphic encryption. One-wayness and semantic security use different composite-residuosity assumptions; the paper does not supply general chosen-ciphertext security. Fast variants, indicative timing tables and the trapdoor-permutation construction are separate subclaims. WRS has not independently reconstructed every reduction or measured the implementation.",
        "domain": "Computer science"
      },
      "sources": [
        {
          "citation": "Pascal Paillier: Public-Key Cryptosystems Based on Composite Degree Residuosity Classes (1999authorversion)",
          "url": "https://www.cs.tau.ac.il/~fiat/crypt07/papers/Pai99pai.pdf"
        }
      ],
      "statement": "# Paillier: add messages while keeping them encrypted\n\nComposite-residuosity classes provide a factorization trapdoor for probabilistic public-key encryption whose ciphertext multiplication implements plaintext addition modulo n, with explicit computational and decisional security assumptions.\n\nOrdinary encrypted messages cannot simply be added together. Paillier constructed a system where multiplying two ciphertexts creates an encryption of the sum of their messages, without revealing the individual messages. The arithmetic takes place modulo a public composite number n and its square. Knowing the secret prime factors enables decryption; fresh randomness hides repeated plaintexts. The 1999 article develops the underlying residuosity-class mechanism and related encryption variants. Its main probabilistic scheme separates one-wayness under a computational assumption from semantic security under a decisional assumption. This is additive homomorphic encryption, not fully homomorphic evaluation of arbitrary programs. Sums wrap modulo n, randomizers must be units, and the basic scheme does not claim protection against chosen-ciphertext attacks. This account follows the complete author-hosted version. An extracted fast-variant complexity statement remains unverified and is excluded from the assessed core.\n\n## Scientific scope\n\nThe basic scheme encrypts messages in Z_n using an admissible base, fresh random units and the stated RSA-like modulus conditions. Its additive homomorphism acts modulo n; it is not fully homomorphic encryption. One-wayness and semantic security use different composite-residuosity assumptions; the paper does not supply general chosen-ciphertext security. Fast variants, indicative timing tables and the trapdoor-permutation construction are separate subclaims. WRS has not independently reconstructed every reduction or measured the implementation.\n\n## People and systems\n\nPascal Paillier\n\n\n\n## Original sources\n\n- [Pascal Paillier: Public-Key Cryptosystems Based on Composite Degree Residuosity Classes (1999authorversion)](https://www.cs.tau.ac.il/~fiat/crypt07/papers/Pai99pai.pdf)\n",
      "summary": "Composite-residuosity classes provide a factorization trapdoor for probabilistic public-key encryption whose ciphertext multiplication implements plaintext addition modulo n, with explicit computational and decisional security assumptions.\n\nOrdinary encrypted messages cannot simply be added together. Paillier constructed a system where multiplying two ciphertexts creates an encryption of the sum of their messages, without revealing the individual messages. The arithmetic takes place modulo a public composite number n and its square. Knowing the secret prime factors enables decryption; fresh randomness hides repeated plaintexts. The 1999 article develops the underlying residuosity-class mechanism and related encryption variants. Its main probabilistic scheme separates one-wayness under a computational assumption from semantic security under a decisional assumption. This is additive homomorphic encryption, not fully homomorphic evaluation of arbitrary programs. Sums wrap modulo n, randomizers must be units, and the basic scheme does not claim protection against chosen-ciphertext attacks. This account follows the complete author-hosted version. An extracted fast-variant complexity statement remains unverified and is excluded from the assessed core.",
      "title": "Paillier: add messages while keeping them encrypted"
    },
    "record_id": "urn:uuid:f3e5bfcc-8093-4ded-adec-3f56eedeb2ab",
    "version": 1,
    "source_ref": {
      "record_id": "urn:uuid:f3e5bfcc-8093-4ded-adec-3f56eedeb2ab",
      "version": 1,
      "content_hash": "sha256:f5648b2b1618f1aff52bf24ae079afd315e975c63431ba1c1812b8838652afbb"
    },
    "export_view": "wrs-public-editorial-view-1",
    "public_view_hash": "sha256:d59d54c1795b7e6562420bd1a95b3539942a521c4a1e289be4d8e49bf9c713cc"
  },
  "target": {
    "record_id": "urn:uuid:f3e5bfcc-8093-4ded-adec-3f56eedeb2ab",
    "version": 1,
    "content_hash": "sha256:f5648b2b1618f1aff52bf24ae079afd315e975c63431ba1c1812b8838652afbb"
  },
  "published_grade": {
    "profile": "wrs-published-grade-1",
    "edition": "2026-10-28.1",
    "id": "paillier-composite-residuosity-additive-encryption-1999",
    "entry_id": "paillier-composite-residuosity-additive-encryption-1999",
    "revision": 1,
    "title": "Paillier: add messages while keeping them encrypted",
    "context": "Computer science",
    "track": "Computer science",
    "band": "A",
    "modifier": null,
    "status": "PROVISIONAL_EDITORIAL",
    "assessed_on": "2026-10-05",
    "evidence_cutoff": "2026-10-05",
    "achievement_state": "SUPPORTED_SCOPED_RESULT",
    "what_changed": "Composite-residuosity classes provide a factorization trapdoor for probabilistic public-key encryption whose ciphertext multiplication implements plaintext addition modulo n, with explicit computational and decisional security assumptions.",
    "scope": "Composite-residuosity classes provide a factorization trapdoor for probabilistic public-key encryption whose ciphertext multiplication implements plaintext addition modulo n, with explicit computational and decisional security assumptions. The basic scheme encrypts messages in Z_n using an admissible base, fresh random units and the stated RSA-like modulus conditions. Its additive homomorphism acts modulo n; it is not fully homomorphic encryption. One-wayness and semantic security use different composite-residuosity assumptions; the paper does not supply general chosen-ciphertext security. Fast variants, indicative timing tables and the trapdoor-permutation construction are separate subclaims. WRS has not independently reconstructed every reduction or measured the implementation.",
    "evidence_summary": "Source-linked, scoped account of the original work. The published scope states the scientific assumptions and remaining verification limits. WRS has not independently certified the full proof, experimental result or system benchmark.",
    "references": [
      {
        "title": "Pascal Paillier: Public-Key Cryptosystems Based on Composite Degree Residuosity Classes (1999 authorversion)",
        "url": "https://www.cs.tau.ac.il/~fiat/crypt07/papers/Pai99pai.pdf",
        "locator": "Original linked work. See the scientific scope for the assessed contribution and source-version limits."
      }
    ],
    "roles": [
      {
        "who": "Pascal Paillier",
        "did": "Sole original byline author of the scoped composite-residuosity and additive-encryption contribution.",
        "credit": "SCIENCE"
      },
      {
        "who": "Goldwasser–Micali; Benaloh; Naccache–Stern; Okamoto–Uchiyama",
        "did": "Explicitly credited prior residuosity and encryption contributions, distinct from this paper's coauthors.",
        "credit": "SCIENCE"
      },
      {
        "who": "Jacques Stern; anonymous referee",
        "did": "Acknowledged in the original paper for independently proving the Class-to-RSA reduction; this specific scientific credit is retained.",
        "credit": "SCIENCE"
      },
      {
        "who": "David Pointcheval; other acknowledged discussants",
        "did": "Acknowledged comments, contributions and discussions; additional byline credit or effort percentages are not inferred.",
        "credit": "PARTICIPATION"
      }
    ],
    "target": {
      "record_id": "urn:uuid:f3e5bfcc-8093-4ded-adec-3f56eedeb2ab",
      "version": 1,
      "content_hash": "sha256:f5648b2b1618f1aff52bf24ae079afd315e975c63431ba1c1812b8838652afbb"
    },
    "scientific_correctness_certified": false,
    "independent_expert_calibration": false,
    "method": "PROPRIETARY",
    "points": "220000"
  },
  "canonical_agent_submission": false,
  "scientific_verification_awarded": false,
  "reader_guide": null,
  "reading_status": "SOURCE_LINKED_NOTE"
}