BGN同态加密算法：

      BGN是一种同态加密方案，是Bonel h等人在2005提出的一种具有全同态性质的加密方案。和传统的仅能支持单同态的elgamal和paillier加密方案不一样，BGN能够同时支持加同态和一次乘同态运算。

      由于乘法同态的实现是通过双线性对性质实现的，所以仅仅只能实现一次的乘同态。

      BGN一般的加密方案如下：

讯享网

BGN在JAVA中的实现：

BGN的实现主要使用JAVA中的大整数math.BigInteger类以及双线性库JPBC实现，具体代码如下：

package BGN; import java.math.BigInteger; import java.security.SecureRandom; import it.unisa.dia.gas.jpbc.Element; import it.unisa.dia.gas.jpbc.Field; import it.unisa.dia.gas.jpbc.PairingParameters; import it.unisa.dia.gas.plaf.jpbc.pairing.a1.TypeA1CurveGenerator; import it.unisa.dia.gas.plaf.jpbc.pairing.a1.TypeA1Pairing; import it.unisa.dia.gas.plaf.jpbc.util.math.BigIntegerUtils; public class BGNEncryption { public static final String start = "start"; public static final String end = "end"; private PairingParameters param; private BigInteger r; private BigInteger q; // This is the private key. private BigInteger order; private SecureRandom rng; public PublicKey gen(int bits) { rng = new SecureRandom(); TypeA1CurveGenerator a1 = new TypeA1CurveGenerator(rng, 2, bits); param = a1.generate(); TypeA1Pairing pairing = new TypeA1Pairing(param); order = param.getBigInteger("n"); r = param.getBigInteger("n0"); q = param.getBigInteger("n1"); Field f = pairing.getG1(); Element P = f.newRandomElement(); P = P.mul(param.getBigInteger("l")); Element Q = f.newElement(); Q = Q.set(P); Q = Q.mul(r); return new PublicKey(pairing, P, Q, order); } public Element encrypt(PublicKey PK, int msg) { BigInteger t = BigIntegerUtils.getRandom(PK.getN()); int m = msg; // System.out.println("Hash is " + m); Field f = PK.getField(); Element A = f.newElement(); Element B = f.newElement(); Element C = f.newElement(); A = A.set(PK.getP()); A = A.mul(BigInteger.valueOf(m)); B = B.set(PK.getQ()); B = B.mul(t); C = C.set(A); C = C.add(B); return C; } public Element add(PublicKey PK, Element A, Element B) { BigInteger t = BigIntegerUtils.getRandom(PK.getN()); Field f = PK.getField(); Element output = f.newElement(); Element aux = f.newElement(); aux.set(PK.getQ()); aux.mul(t); output.set(A); output.add(B); output.add(aux); return output; } public Element mul(PublicKey PK, Element C, Element D) { BigInteger t = BigIntegerUtils.getRandom(PK.getN()); // double t1 = System.currentTimeMillis(); Element T = PK.doPairing(C, D); // double t2 = System.currentTimeMillis(); // System.out.println("一次对运算操作的时间"+(t2-t1)+"ms"); Element K = PK.doPairing(PK.getQ(), PK.getQ()); K = K.pow(t); return T.mul(K); } public String decryptMul(PublicKey PK, BigInteger sk, Element C) { Element PSK = PK.doPairing(PK.getP(), PK.getP()); PSK.pow(sk); Element CSK = C.duplicate(); CSK.pow(sk); Element aux = PSK.duplicate(); BigInteger m = new BigInteger("1"); while (!aux.isEqual(CSK)) { aux = aux.mul(PSK); m = m.add(BigInteger.valueOf(1)); } return m.toString(); } public String decrypt(PublicKey PK, BigInteger sk, Element C) { Field f = PK.getField(); Element T = f.newElement(); Element K = f.newElement(); Element aux = f.newElement(); T = T.set(PK.getP()); T = T.mul(sk); K = K.set(C); K = K.mul(sk); aux = aux.set(T); BigInteger m = new BigInteger("1"); while (!aux.isEqual(K)) { // This is a brute force implementation of finding the discrete // logarithm. // Performance may be improved using algorithms such as Pollard's // Kangaroo. aux = aux.add(T); m = m.add(BigInteger.valueOf(1)); } return m.toString(); } public static void main(String[] args) { BGNEncryption b = new BGNEncryption(); PublicKey PK = b.gen(256); BigInteger f = PK.getN(); Element P = PK.getP(); Element Q = PK.getQ(); BigInteger order = PK.getN(); int len1 = P.getLengthInBytes(); int len2 = Q.getLengthInBytes(); int len3 = order.bitLength(); Element msg1 = b.encrypt(PK, 20); int len = msg1.getLengthInBytes(); Element msg2 = b.encrypt(PK, 25); int len6 = msg2.getLengthInBytes(); Element add = b.add(PK, msg1, msg2); String jiemi = b.decrypt(PK, b.q, add); System.out.println("Addition: "+jiemi); int len4 = add.getLengthInBytes(); // double t5 = System.currentTimeMillis(); Element mul = b.mul(PK, msg1, msg2); // double t6 = System.currentTimeMillis(); // System.out.println("一次同态乘法的时间"+(t6-t5)+"ms"); System.out.println("Mul: " + b.decryptMul(PK, b.q, mul)); int len5 = mul.getLengthInBytes(); System.out.println("P的长度:"+len1); System.out.println("Q的长度:"+len2); System.out.println("阶为:"+len3); System.out.println("msg1的长度:"+len); System.out.println("加同态"+len4); System.out.println("乘同态"+len5);

讯享网package BGN; import it.unisa.dia.gas.jpbc.Element; import it.unisa.dia.gas.jpbc.Field; import it.unisa.dia.gas.plaf.jpbc.pairing.a1.TypeA1Pairing; import java.math.BigInteger; public class PublicKey { private TypeA1Pairing map; private Element P, Q; private BigInteger n; private Field f; public PublicKey(TypeA1Pairing pairing, Element gen, Element point, BigInteger order) { map = pairing; P = gen.set(gen); Q = point.set(point); n = order; f = pairing.getG1(); } public Element doPairing(Element A, Element B) { return map.pairing(A, B); } public Element getP() { return this.P; } public Element getQ() { return this.Q; } public BigInteger getN() { return this.n; } public Field getField() { return this.f; } } 

同态实验结果：

Addition: 45 Mul: 500 P的长度:130 Q的长度:130 阶为:512 msg1的长度:130 加同态130 乘同态130 

代码出处：https://stackoverflow.com/questions//bgn-implementation-in-java

                  https://github.com/andyjojo/bgn