Privacy-Preserving Greater-Than Integer Comparison without

Binary Decomposition

Sigurd Eskeland

Norwegian Computing Center, Postboks 114 Blindern, 0314 Oslo, Norway

Keywords:

Privacy-Preserving Integer Comparison, Privacy Protocols, Homomorphic Cryptography.

Abstract:

Common for the overwhelming majority of privacy-preserving greater-than integer comparison schemes is

that cryptographic computations are conducted in a bitwise manner. To ensure secrecy, each bit must be

encoded in such a way that nothing is revealed to the opposite party. The most noted disadvantage is that the

computational and communication cost of bitwise encoding is at best linear to the number of bits. Also, many

proposed schemes have complex designs that may be difﬁcult to implement. Carlton et al. (2018) proposed an

interesting scheme that avoids bitwise decomposition and works on whole integers. A variant was proposed by

Bourse et al. (2019). Despite that the stated adversarial model of these schemes is honest-but-curious users,

we show that they are vulnerable to malicious users. Inspired by the two mentioned papers, we propose a

novel comparison scheme, which is resistant to malicious users.

1 INTRODUCTION

The idea of the Millionaire’s Problem (Yao, 1982) is

to facilitate two millionaires, who do not trust each

other and who do not want to reveal their worth to

each other, to ﬁnd out who is the richest. Although

such tasks could trivially be solved by a trusted third

party who decides which party has the greatest value,

the goal is to replace the trusted party with a privacy-

preserving protocol. In other words, it is the ability to

conduct privacy-preserving greater-than integer com-

parisons (PPGTC) without a trusted third party.

PPGTC may be used as a subprotocol for

conducting privacy-preserving computations on en-

crypted data sets. Practical applications are auctions

with private biddings, voting systems, privacy-

preserving database retrieval and data-mining,

privacy-preserving statistical analysis, genetic

matching, face recognition, privacy-preserving set

intersection computation, etc.

Privacy-preserving integer comparison is an ac-

tive research ﬁeld that is based on techniques such as

homomorphic encryption, garbled circuits, oblivious

transfer, and secret sharing. Authors generally tend

to claim some improvement over some other scheme

in particular with regard to efﬁciency, but the actual

efﬁciency may not be readily comparable (for exam-

ple, due to methods are very different) nor available

in many papers. Common for the overwhelming ma-

jority of privacy-preserving greater-than integer com-

parison schemes is that cryptographic computations

are conducted in a bitwise manner. To ensure se-

crecy, each bit of the private inputs must be encoded

in such a way that nothing is revealed to the oppo-

site party. Bitwise cryptographic processing results in

high computational and communication costs that is

proportional to data input sizes. Also, many proposed

schemes have complex designs that may be difﬁcult

to implement.

Carlton et al. (2018) a PPGTC scheme that works

on whole integers and that does not require bitwise

coding or encryption. Inspired by (Damg

ard et al.,

2008a; Damg

ard et al., 2008b), it makes use of a spe-

cial RSA modulus. Blinding is conducted to protect

the input values. At the end of the protocol, a plain-

text equality test (PET) subprotocol determines the

outcome of the comparison, which imposes an addi-

tional performance cost. Bourse et al. (2019) pro-

posed a slightly modiﬁed two-pass PPGTC protocol

that avoids the PET subprotocol, and whose function

is simply replaced by a control value that is sent to

party A in the last pass. By means of this value,

party A determines the outcome of the comparison.

A disadvantage of the Bourse scheme compared

to the Carlton scheme is a signiﬁcantly smaller up-

per bound of private inputs and a composite modu-

lus, whose size exceeds those recommended for RSA,

even at small input bounds.

340

Eskeland, S.

Privacy-Preserving Greater-Than Integer Comparison without Binary Decomposition.

DOI: 10.5220/0009822403400348

In Proceedings of the 17th International Joint Conference on e-Business and Telecommunications (ICETE 2020) - SECRYPT, pages 340-348

ISBN: 978-989-758-446-6

The stated adversarial model of the Carlton and

Bourse schemes is honest-but-curious users, i.e., par-

ticipants that do not deviate from protocol speciﬁca-

tion concerning how messages are computed. The

overall motivation for using privacy-preserving pro-

tocols has to do with lack of trust, where privacy-

preserving methods allow individuals who do not trust

each other to conduct computations without disclos-

ing their private inputs. The assumption of honest-

but-curious users is therefore somewhat a contradic-

tion to the assumption that users do not trust each

other.

Contribution. In this paper, we show that Carlton

and Bourse schemes are insecure with regard to mali-

cious users, i.e., participants whose message compu-

tations deviate from the protocol speciﬁcation. In par-

ticular, the attacks presented in this paper are unde-

tectable, which underlines that the honest-but-curious

adversarial assumption is arguable insufﬁcient. We

propose a novel PPGTC scheme that seeks to miti-

gate the mentioned schemes’ insecurities w.r.t. ma-

licious users. It has only two rounds, and the upper

plaintext bounds are favorably comparable with the

Carlton scheme.

Outline. Section 2 provides necessary prelimi-

naries and presents the basic idea of the compari-

son mechanisms used by the mentioned Carlton and

Bourse schemes, and the one proposed in this paper.

Section 3 outlines the Bourse scheme. Attacks on this

scheme is presented in Section 4. The Carlton scheme

and an attack are presented in Section 5. In Section 6

our novel PPGTC scheme is presented.

2 PRELIMINARIES

The main feature of the PPGTC schemes proposed

by Carlton et al. (2018) and Bourse et al. (2019) is

the ability to compare entire integers, as opposed to

bitwise operation on encrypted bits. This is achieved

by special cyclic subgroups realized by making use of

the following parameters:

• a and d, where 0 < a ≤ d and d/a denotes the

upper bound of m

≤ d/a. Note that a does

not exist in the Carlton scheme, where solely d

denotes the upper bound of private inputs.

• Let n = pq, where p and q are primes and

– p = p

+ 1 and q = p

+ 1 if p

= 2

– p = 2p

+ 1 and q = 2p

+ 1 if p

is a

small odd prime

and p

, p

are distinct primes. See Sec-

tion 2.1 for details on how to set the sizes of these

primes.

•

b denotes an upper public bound of p

• g is a generator of a cyclic subgroup G ⊂ Z

∗

order p

• h is a generator of a cyclic subgroup H ⊂ Z

∗

order p

• c is a long-term private key that is used by party A,

where

c = p



mod p



(1)

The public key is {n,a,d, p

,g,h,

b}, and the private

key of party A is {p,q,c}. The core idea behind the

Carlton scheme is that the element

d+m

−m

mod n (2)

where 0 ≤ m

≤ d, can be used to compare two

integers m

and m

, due to whether multiples of the

exponential factors p

exceed p

or not, so that

d+m

−m



6= 1 if m

< m

= 1 if m

≥ m

This construction is almost identical in the Bourse

scheme, which has an additional public parameter a,

where integer comparison is conducted according to

d+a·(m

−m

)

mod n (3)

where 0 ≤ m

≤ d/a.

2.1 Prime Sizes

The upper plaintext bound

m and the chosen security

level λ determine prime sizes. Primes p

and q

have

to be greater than 256 bits in order to thwart Coron’s

attack (Coron et al., 2010) that factors the RSA mod-

ulus.

Let ` denote the size of p and q; s denote the size

of p

and q

, which should be s ≤ 256; and t denote

the size of p

and q

. The upper plaintext bound sets

d =

m in the Carlton scheme and d = a ·

m in the

Bourse scheme. If log

) + s > ` then let t = 0 and

= q

= 1. Otherwise, let t = ` − log

) − s. The

latter applies only for the cases where

m is small, and

and q

are needed to increase the sizes of p and q

so that the security level of n agrees with λ.

3 THE BOURSE SCHEME

The Bourse scheme is summarized in Figure 1. In the

ﬁrst pass, party A generates the random r

and blinds

by computing

C = g

a·m

mod n

Privacy-Preserving Greater-Than Integer Comparison without Binary Decomposition

341

Subsequently in the second pass, party B randomly

generates r

,u,v, and blinds m

in the responding

computation:

D = C

u·p

d−a·m

mod n

and the control value D

= f (g

), where f is a secure

hash function. Finally, party A computes

= D

= (C

u·p

d−a·m

)



a·m

)

u·p

d−a·m



= (g

a·m

)

u·p

d−a·m

= g

u·p

d+a·(m

−m

)

(4)

Due to the private key c, each factor of base h is elim-

inated, so that C

∈ G.

3.1 Security Assumptions

The security of the ﬁrst round of both the Carlton and

Bourse schemes relies on the small RSA subgroup de-

cision assumption. The following deﬁnition is from

the Bourse paper (Bourse et al., 2019):

Deﬁnition 1 (The small RSA subgroup decision

assumption) This assumption holds if given an

RSA quintuple (u, p

,d, n, g), the distributions x and

are computationally indistinguishable from a

uniformly random quadratic residue x = r

mod n.

This assumption states that it is hard to distinguish el-

ements in H ⊂ Z

∗

of order p

(generated by h) from

a random quadratic residue in Z

∗

. In other words, it

holds if it is not possible to determine if an integer

belongs to H or not. It applies solely to C in the ﬁrst

round as a measure for whether the subgroup order of

the masking factor h

∈ H achieves necessary secu-

rity.

The security of the second round relies on sta-

tistically indistinguishable uniform distributions in a

subgroup of order p

, which is considerably smaller

than that of H. In the second round, party B gener-

ates three secret random secret integers (r

,u,v) and

sends (D,D

) to party A, who computes C

. Given C

party A can guess either g

u·p

d+a·(m

−m

)

or g

, where

the correctness of each guess is veriﬁed w.r.t. D

3.2 Security Parameter Considerations

The integers p

,a determine the security level λ of D

in Round 2 and d:

= 2

where a = λ

log2

log p

(5)

and d = a ·

m. In agreement with Eq. 3, the input val-

ues (m

) deﬁne subgroups G

⊆ G of variable or-

der if m

< m

| = p

d−a·(m

−m

)

≥ 2

The smallest subgroup G

is produced by m

− m

−1, where p

d+a·(m

−m

)

= p

d−a

. For this case, the

effective range of the random integer u is 0 < u < p

cf. Eq. 5. Assuming that p

is big enough, the Bourse

scheme is secure w.r.t. honest-but-curious users. Sec-

tion 4 discusses how a malicious user can reduce this

range to make it searchable.

The private input upper bound

m is conﬁned by the

RSA modulus size. Table 1 shows integer sizes as a

function of λ and

m, where ` denotes the size of p and

q. It assumes that p

= 2 and s = 256 bits, cf. Sec-

tion 2.1. NIST recommends that the RSA modulus

should be 2048 bits for a λ = 112 bits security level,

and 3072 bits for λ = 128 bits security.

The moduli

lengths given in the table exceed the RSA recommen-

dations, meaning that p

are not needed. The fore-

Table 1: Parameter sizes for the Bourse scheme, where p

m a d ` |n|

112 10 112 1120 1376 2752

112 50 112 5600 5856 11712

112 100 112 11200 11456 22912

128 10 128 1280 1536 3072

128 50 128 6400 6656 13312

128 100 128 12800 13056 26112

most downside is the limitation of low upper bounds

on private inputs, which, as in the example, causes a

very large composite n that signiﬁcantly exceeds that

which is recommended for RSA.

4 MALICIOUS USER ATTACKS

The Bourse scheme assume honest-but-curious users

that do not deviate from the protocol. A user that

is motivated to disclose the private input of another

user may be inclined to deviate from the protocol for

this purpose. In this section we show that the Bourse

scheme is insecure with regard to dishonest users, in

particular party A. The consequence is that party A

may obtain the private input of party B, who will not

know that a privacy breach has occurred. Note that the

following attacks do not apply to the Carlton scheme,

http://www.keylength.com

SECRYPT 2020 - 17th International Conference on Security and Cryptography

342

Party A Party B

Private key c

∈ {1...

b} r

∈ {1...

u ∈ {1... p

},u - p

v ∈ {1... p

},v - p

C = g

a·m

−−−−−−−−−−−−−−−−−−−→

D = C

u·p

d−a·m

= f (g

)

D,D

←−−−−−−−−−−−−−−−−−−−

= D

If D

= f (C

)

Then m

≥ m

Else m

< m

Figure 1: The Bourse et al. comparison scheme.

presented in Section 5, due to using a PET subproto-

col.

4.1 Fixed Value Attack

This attack pertains to the initial computation con-

ducted by party A. In Round 1, party A selects k =

a − 1, and sends C = g

to party B. In Round 2,

party B computes and returns (D, D

) to party A, who

lastly computes

= g

u·p

·p

d−am

= g

u·p

a−1+d−am

Consider the following cases:

Case 1. If m

= 0 then

= g

u·p

a−1+d

= g

Case 2. If m

= 1 then

= g

u·p

a−1+d−a

= g

·p

d−1

where 0 < u

< p

Case 3. If m

> 1 then

= g

u·p

a−1+d−am

= g

·p

d−a(m

−1)−1

where 0 < u

< p

a·(m

−1)+1

The two ﬁrst cases are trivial for party A to identify

by checking w.r.t. the hash value D

. For the third

case, assuming that p

is big enough, it would not be

possible for party A to recover g

and then m

4.2 Selected Value Attack

The previous attack can be generalized for any pres-

elected value of m

, meaning if party A computes C

w.r.t. a speciﬁc value m

, it will give him or her assur-

ance whether this is the value submitted by party B in

Round 2.

In Round 1, party A selects k = a m

− 1, and

sends C = g

to party B. Lastly, party A obtains

≡ (g

)

u·p

d−a·m

≡ g

·(p

a·m

−1+d−a·m

)

≡ g

·p

d+a·(m

−m

)−1

Consider the following cases:

Case 1. If m

> m

then C

= g

Case 2. If m

= m

then

= g

u·p

d−1

= g

·p

d−1

where 0 < u

< p

Case 3. If m

< m

then

= g

d−a·(m

−m

)−1

where 0 < u

< p

a·(m

−m

)+1

As was for the ﬁxed value attack, the two ﬁrst cases

are trivial for party A to identify. For the third case,

assuming that a is big enough, it would not be possi-

ble for party A to recover m

Privacy-Preserving Greater-Than Integer Comparison without Binary Decomposition

343

4.3 Public Keys with Tiny Hidden

Subgroups

A common assumption in public key cryptography is

that users generate their own key pairs and then ex-

change public keys. In the Bourse scheme, Party A is

the holder of the private key, and would provide the

key pair. A malicious party A could generate a spu-

rious public key (n, g,h, p

,a,d) with a signiﬁcantly

smaller subgroup than speciﬁed in order to obtain pri-

vate inputs by small brute-force searches.

The following describes how public keys with tiny

subgroups can be computed for the Bourse scheme:

• p

, a, d are selected in accordance with Section 2.

• Select a prime p

that is close to d, i.e., p

& d, so

that the small prime p

is a generator (i.e., primi-

tive root) to p

• Let n = pq be the product of two primes, where

p = p

+1 and q = p

+1, and p

, p

are generated in accordance with Section 2.

• g and h are generated in accordance with Sec-

tion 2.

g will now generate a tiny subgroup G

conﬁned by

, so that |G

| = p

−1. Due to the following modular

equivalence, it holds that

= g

u·p

d+a·(m

−m

)

≡ g

·p

d+a·(m

−m

)

(mod n)

where 0 < u

< p

, cf. Eq. 4. Accordingly, D

f (g

) = f (g

Following the Bourse protocol, the malicious

party A interacts with the honest party B. In Round 1,

party A sends C = gh

to party B. Party A can then

easily ﬁnd the low-entropy v

w.r.t. checking D

f (g

). Knowing v

, party A ﬁnds 0 ≤ x ≤ p

w.r.t.

= g

where x = u

· p

d−a·m

This attack is prevented by validating g and n by

checking that g

≡ 1 (mod n) holds.

5 THE CARLTON SCHEME

The Carlton scheme is shown in Fig. 2. The public

key (n, p

,d, g,h) and private key c is generated in

agreement with Section 2. It uses a plaintext equality

test in the end. Note that in Carlton et al. (Carlton

et al., 2018), p

is denoted as b, and c as x.

The correctness of C

is given by

= D

= (g

)

d−m

= g

d+m

−m

where similar to Eq. 4, the factors of base h are elim-

inated. The security of Round 1 is based on the small

RSA subgroup decision assumption, cf. Deﬁnition 1.

The security of Round 2 is based on the secrecy of

. Note that the Carlton scheme is more favorable

than the Bourse scheme by considerably larger upper

bounds on private inputs, as seen in Table 2.

Table 2: Parameter sizes for the Carlton scheme and our

scheme, p

= 2.

m d ` |n|

112 100 100 1024 2048

112 1000 1000 1256 2512

112 5000 5000 5256 10512

128 100 100 1536 3072

128 1000 1000 1536 3072

128 5000 5000 5256 10512

5.1 Known Subgroup Attacks

Similar to the Bourse scheme, the Carlton scheme as-

sumes honest-but-curious users. From the perspective

of malicious users, the attacks presented in Section 4

do not apply to the Carlton scheme due to the way

that the ﬁnal integer comparison is conducted. But as

we show next, the Carlton scheme is nevertheless not

secure with regard to malicious users.

The computation of the integer D in the Carlton

scheme is similar to that of the Bourse scheme, except

for that in the Bourse scheme the factor C

u·p

d−a·m

D is “randomized” by u over a larger subgroup deter-

mined by p

. The lack of this feature in the Carlton

scheme can be exploited by party A.

Since party A is the holder of the private key, we

assume that party A knows the composition of the

RSA modulus. Knowing subgroup orders does not

make this party malicious as long as he acts in agree-

ment to the protocol. There may be several variant

attacks, where a party knows subgroup orders. One

variant is as follows:

Party A sends to C = α

to party B, where r is a

random number — thereby deviating from how the

protocol speciﬁes this computation. Party B has no

way to determine this, and computes D according to

protocol. Finally, Party A computes

·p

·q

= (α

r·p

d−m

)

= α

r·p

2·d−m

·p

·q

SECRYPT 2020 - 17th International Conference on Security and Cryptography

344

Party A Party B

Private key c

∈ {1...

b} r

∈ {1...

s ∈ {1... p

− 1}

C = g

−−−−−−−−−−−−−−−−−−−→

D = C

(d−m

)

←−−−−−−−−−−−−−−−−−−−

= D

w = log

)

PET(w,s)

←−−−−−−−−−−−−−−−−−−→

If w = s

Then m

≥ m

Else m

< m

Figure 2: The Carlton et al. comparison scheme.

eliminating factors of base g and h. Knowing before-

hand α

r·p

·q

, party A then easily recovers m

6 A NOVEL

PRIVACY-PRESERVING

GREATER-THAN

COMPARISON SCHEME

In this section we present a novel privacy-preserving

greater-than integer comparison protocol. Inspired

by the two previous schemes (Carlton et al., 2018;

Bourse et al., 2019), our scheme uses a cyclic sub-

group of a power order p

. Similar to the Carlton

scheme, two integers m

and m

are compared in a

privacy-preserving manner in agreement with Eq. 2,

which avoids the restricted bounds on private inputs

of the Bourse scheme.

6.1 Construction

The proposed scheme requires the following parame-

ters:

• n = pq, where p and q are large primes, and

– p = p

+ 1 and q = p

+ 1 if p

= 2

– p = 2p

+ and q = 2p

+ 1 if p

is a small

odd prime

where p

and q

are distinct primes.

• d denotes the upper bound of the private inputs:

0 ≤ m

< d.

•

b denotes an upper public bound of p

• α is a small generator to Z

and Z

• A private key g = α

mod n generating ele-

ments in G of order p

Public parameters are {n, d, p

b}. The private key

g is held by Alice. We therefore assume that Alice

issues the public key and knows the construction of n.

The proposed scheme is summarized in Figure 3.

In Round 1, Bob shares:

x = α

and β = α

d−m

with Alice. In Round 2, Alice should check that x 6= 1

and x 6= α. Alice computes and sends:

y = g

= g

and

γ = f (β

) = f ((α

d−m

)

= f (α

d−m

)

(6)

to Bob, where f is a secure hash function. Finally,

Bob computes:

w = y

d−m

= (g

)

d−m

= g

d+m

−m

d−m

= g

d+m

−m

(α

d−m

)

= g

d+m

−m

(7)

Privacy-Preserving Greater-Than Integer Comparison without Binary Decomposition

345

Alice Bob

Private key g

∈ {1...

b} r

∈ {1...

∈ {1...d}, r

- p

∈ {1...

b},r

- p

x = α

β = α

d−m

x,β

←−−−−−−−−−−−−−−−−−−−

y = g

γ = f (β

)

y,γ

−−−−−−−−−−−−−−−−−−−→

w = y

d−m

If f (w) = γ

Then m

≥ m

Else m

< m

Figure 3: The proposed secure comparison protocol.

and checks whether:

f (w)

= γ

There are two outcomes:

• f (w) = γ because w = β

and m

≥ m

• f (w) 6= γ because w 6= β

and m

< m

with an

overwhelming probability.

Note that the secret ephemeral integers r

should

not be divisible by p

to avoid reduction of the order

of the elements based on g.

6.2 Security Parameter Considerations

The bounds of private inputs is conﬁned by the RSA

modulus size. As mentioned, RSA modulus recom-

mendations are 2048 bits for a λ = 112 bits security

level, and 3072 bits for λ = 128 bits security. Table 2

shows parameter sizes as a function of security level

λ and maximum input bound

m, where ` denotes the

size of p and q.

7 SECURITY ANALYSIS

The security relies on indistinguishability of random

distributions, except for when it comes to a malicious

users, who submits a computation that deviates from

the protocol speciﬁcation. This is a reasonable sce-

nario, as such deviating computations cannot be de-

tected by the opponent, which again underlines that

the honest-but-curious adversarial assumption is an

insufﬁcient assumption.

Note that the attacks ﬁxed and selected value at-

tacks in Sections 4.1 and 4.2 do not apply to our

scheme, since they assume that the generator g is pub-

lic. The known subgroup attack in Section 5.1 does

not apply directly to our scheme, but reduced sub-

groups are addressed in Section 7.2. The tiny hidden

subgroups attack in Section 4.3 is addressed in this

analysis.

The following security assumption applies for ma-

licious users, as shown in this section:

Deﬁnition 2 (The Private RSA Subgroup Problem).

Given the RSA modulus n and an integer R = α

this computational problem is the difﬁculty of comput-

ing R

= g

under the assumption that g and c (de-

ﬁned in Eq. 1) are not known, and where g generates

the subgroup G.

This problem hinges on the difﬁculty of factorizing n.

Note that the small RSA subgroup decision assump-

tion does not apply to our scheme, as there is no sub-

group H. In line with the previous discussions, the

following security analysis considers the two adver-

sarial models separately.

7.1 Security w.r.t. Honest-but-Curious

Users

In this section, we prove that the proposed protocol

preserve the conﬁdentiality of private inputs against

honest-but-curious adversaries in the standard model.

Lemma 1 (Privacy of Bob). The secrecy of m

preserved assuming an honest-but-curious opponent.

Proof. In Round 1, Alice receives x,β, whose expo-

nents carry the private input m

SECRYPT 2020 - 17th International Conference on Security and Cryptography

346

• x: Given that r

of the blinding factor α

in x

is a uniform random value, x is indistinguishable

from α

, where z is a uniform random value. The

secrecy of α

is therefore preserved.

• β: Given that both factors of β, i.e., α

and

d−m

, have random exponents render them

indistinguishable from α

, where z is also a uni-

form random value. The secrecy of α

d−m

therefore preserved.

Since x,β are indistinguishable from random integers

in Z

∗

, the secrecy of m

is therefore preserved. 

Note that x,β have the common exponents

, p

, which may yield a corresponding corre-

lation. This is accounted for in the analysis in Sec-

tion 7.2.

Lemma 2 (Privacy of Alice). The secrecy of m

preserved assuming an honest-but-curious opponent.

Proof. Let m

= 0 to potentially extract m

for the

whole range of [1...d]. In Round 2, Bob receives y,γ.

Regarding y, the factor g

= g

is blinded by x

Honest-but-curious users implies that α is the ac-

tual element used to compute x, according to proto-

col, so that x

∈ B ⊂ Z

∗

, where |B| =

b. The security

hinges on the secrecy of r

• Brute-force attack: Given β and γ, r

can be found

by checking f (β

)

= γ, cf. Eq. 6. Since

b = |p

is very large, it is computationally infeasible to

brute-force r

. The secrecy of g

and thus m

preserved.

• Pre-image attack: Bob computes

w = y

d−m

= g

d+m

−m

cf. Eq. 7, where g

d+m

−m

, which contains the

private input m

, is blinded by β

. The blinding

factor can be disclosed by computing the inverse

−1

(γ) = β

. This is equivalent to breaking the

pre-image resistance property of the hash function

f . Assuming the one-way function f is secure,

this is computationally infeasible.

Given the above, the secrecy of m

is preserved

against an honest-but-curious adversary. 

7.2 Security w.r.t. Malicious Users

Since Alice is the holder of the private key, we can as-

sume that Alice computes the key pair, and therefore

knows the composition of the RSA modulus. Since

Bob is the initiator of the protocol, Alice cannot cheat

Bob by sending him spurious protocol messages. This

conﬁnes the adversarial scenarios to:

1. Alice submits a spurious public key α

to Bob.

2. Bob diverges from the protocol at computing x,β.

Alice could share a spurious RSA modulus n

with

Bob, cf. Section 4.3. Alternatively, the attack in Sec-

tion 5.1 utilizes the subgroup G of order p

of the

genuine RSA modulus. However, this subgroup may

be too large for brute-forcing.

By means of the private key g, Alice controls

the pertaining small subgroup order G

, by which it

is computationally feasible to search for the corre-

sponding exponent ˆe, given the modular equivalence

ˆg

ˆe

≡ α

(mod n

), where ˆe = e mod p

and p

= |G

Lemma 3 (Privacy of Bob). The secrecy of m

preserved given a spurious RSA modulus with a tiny

hidden subgroup order G

Proof. Let n

be a spurious RSA modulus having

a tiny hidden subgroup G

. W.r.t. x, β, assume

that Alice obtains the modular equivalent exponents

a,b of the equivalences x ≡ g

(mod n

) and β ≡ g

(mod n

), where a,b form the following equation sys-

tem:

a = p

+ r

mod p

b = p

+ p

d−m

mod p

Since the number of unknowns exceed the number of

equations, the equation system is underdeﬁned. m

can therefore not be determined. The secrecy of m

preserved given a spurious RSA modulus. 

A malicious user Bob may submit any integer to

Alice, and use the response y,γ and n to ﬁgure out

her private input. Bob would succeed if he is able

to correctly guess the blinding factor x

or g

although Bob does not know g.

Lemma 4 (Privacy of Alice). The secrecy of m

preserved assuming a malicious opponent.

Proof. This lemma is invalided by the following at-

tack: A malicious Bob reduces the group order by p

of x by submitting x = α

to Alice, who returns

y = g

= g

in agreement with the protocol. (Note that Alice must

check that x 6= 1, since this would expose g

Bob computes y

= g

, where c is deﬁned in

Eq. 1, eliminating the blinding factor α

. Bob

ﬁnds m

by checking (g

)

= 1 for 0 < i < d.

Alternatively, Bob could correctly guess r

whereof the search space of 0 < r

< p

may or may

not be feasible, and then compute α

, whose

correctness is veriﬁed towards γ.

Privacy-Preserving Greater-Than Integer Comparison without Binary Decomposition

347

Both approaches require solving the private RSA

subgroup problem (cf. Def. 2). This is solvable pro-

vided that the RSA modulus can be factorized. If

the RSA modulus is properly composed, this would

be computationally infeasible. The secrecy of m

therefore preserved. 

8 CONCLUSION

Common for the overwhelming majority of privacy-

preserving greater-than integer comparison schemes

is that cryptographic computations are conducted in

a bitwise manner. Recently, Carlton et al. (Carl-

ton et al., 2018) and Bourse et al. (Bourse et al.,

2019) proposed privacy-preserving integer compari-

son schemes that work on whole integers in contrast

to bitwise decomposition and encoding of the private

inputs.

In this paper, we have presented the mentioned

comparison schemes, and shown that they are vulner-

able to malicious users. Inspired by the two men-

tioned papers, we have proposed a novel privacy-

preserving greater-than integer comparison scheme,

which is resistant to malicious users.

REFERENCES

Bourse, F., Sanders, O., and Traor

e, J. (2019). Improved

secure integer comparison via homomorphic encryp-

tion. Cryptology ePrint Archive, Report 2019/427.

https://eprint.iacr.org/2019/427.

Carlton, R., Essex, A., and Kapulkin, K. (2018). Thresh-

old properties of prime power subgroups with ap-

plication to secure integer comparisons. Cryptology

ePrint Archive, Report 2018/224. https://eprint.iacr.

org/2018/224.

Coron, J.-S., Joux, A., Mandal, A., Naccache, D., and Ti-

bouchi, M. (2010). Cryptanalysis of the rsa subgroup

assumption from tcc 2005. Cryptology ePrint Archive,

Report 2010/650. https://eprint.iacr.org/2010/650.

Damg

ard, I., Geisler, M., and Krøigaard, M. (2008a). Ho-

momorphic encryption and secure comparison. Inter-

national Journal of Applied Cryptography, (1):22–31.

Damg

ard, I., Geisler, M., and Krøigaard, M. (2008b). A

correction to ”efﬁcient and secure comparison for

on-line auctions”. IACR Cryptology ePrint Archive,

2008:321.

Yao, A. C. (1982). Protocols for secure computations. In

Proceedings of the 23rd Annual Symposium on Foun-

dations of Computer Science, SFCS ’82, pages 160–

164, Washington, DC, USA. IEEE Computer Society.

SECRYPT 2020 - 17th International Conference on Security and Cryptography

348