A new hard-core predicate of Paillier's trapdoor function

Abstract

At EuroCrypt '01, Catalano et al. [1] proved that for Paillier's trapdoor function if computing residuosity class is hard, then given a random w ∈ ℤ*N2 the least significant bit of its class is a hard-core predicate. In this paper, we reconsider the bit security of Paillier's trapdoor function and show that under the same assumption, the most significant bit of the class of w is also a hard-core predicate. In our proof, we use the "guessing and trimming" technique [2] to find a polynomial number of possible values of the class and devise a result checking method to test the validity of them. © 2009 Springer-Verlag.