Mathematics Stack Exchange is a question and answer site for people studying math at any level and professionals in related fields. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In the Paillier cryptosystem, suppose that I know a Ciphertext encrypted with some unknown random $r$ i.e.

$$C = (g^m r^n) \bmod n^2 $$

I know $g, n$, the prime factorization of $n$, i.e., $pq$. I also know the private key $-$ hence I know the message $m$. Would there be a way for me to recover $r$ easily?

share|cite|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.