Performance bottlenecks in Paillier encryption

Question

I'm implementing Paillier encryption and I'd like some recommendations about improving its performance.

Firstly, I have to note the following:

• I have already set g=1+n to get rid of one exponentiation.
• I've been using the CRT to improve decryption.

Nevertheless, the computation of r^n mod n^2 is rather intensive, do you have any other trick to improve the performance?

Note: I don't want to use the Catalano et al. improvement with e as I want to keep its homomorphic property intact.

Answer 1

Recall that in Paillier encryption with public key $n$ of private factorization and $g=1+n$, encryption of plaintext $m$ reduces to:

• choose random $r$, $0<r<n$
• compute and output ciphertext $c=(1+n\cdot m)\cdot r^n\bmod n^2$.

Some ideas:

1. In some contexts, it is feasible to pre-compute $r^n\bmod n^2$ in masked time, before the encryption itself, meaning there is no modular exponentiation involved in encryption (only one multiplication and one modular multiplication); delay from plaintext-in to ciphertext-out is thus drastically reduced.
2. Using existing tightly optimized modular exponentiation code like in GMP might achieve 3, 4 and 5 below with little effort.
3. Tight coding (often, assembly) pays a lot for modular multiplication, and thus modular exponentiation (which is dominated by modular multiplication). Gaining a factor of 3 is common, 10 is not unseen if assembly coding allows to double the effective word width used for multiplication (e.g. C might not allows to use the full 128-bit result of a 64-bit times 64-bit multiplication available in hardware, or effective use of the carry bit).
4. Depending on hardware and size of $n$, it might pay to perform some optimizations that are not worthwhile for RSA and $n$ of comparable size, because the modulus width for modular multiplications is doubled in Paillier; even quadrupled (or more with multiprime-RSA) if the CRT is used and one compares the expensive operations, which are encryption in Paillier, and decryption in RSA. These optimizations include

• sub-quadratic multiplication, like Karatsuba and friends;
• modular reduction by multiplication with pre-computed inverse;
• performing modular squaring by squaring with reuse of partial products (as in Algorithm 14.16 in the HAC) followed by modular reduction.

5. Sliding Window exponentiation (see Algorithm 14.85 in the HAC) will give some improvement (like -20%) over a standard exponent scanning, and slightly more so than in RSA.
6. [Update] Most important, but perhaps already in the question: for decryption (only), a CRT method giving improvement by a factor approaching 4 (for standard multiplication algorithms; 3 with Karastuba) is described in this answer.