pypaillier

Additively homomorphic Paillier encryption: a Rust implementation on top of GMP, bound to Python through pyo3.

Add encrypted numbers without decrypting them:

import paillier

pub, sec = paillier.generate_keypair(2048)

blobs = [bytes(b) for b in paillier.encrypt_many(pub, [1.5, 2.25, -0.75])]
total = paillier.add_many(pub, blobs)      # adding CIPHERTEXTS

paillier.decrypt(sec, total)               # 3.0

Whoever does the adding never sees the terms. Whoever holds the private key sees only the sum.

pip install pypaillier

Wheels for CPython 3.10–3.13, manylinux_2_17. No compiler and no system GMP required. The distribution is pypaillier; the import name is paillier.

📖 Documentation

Before you use it

This is not textbook Paillier. The scheme is the Damgård–Jurik variant with a short exponent, c = (1 + m·n) · hs^r mod n². Ciphertext indistinguishability therefore rests on an additional short-exponent assumption, not on DCRA alone.

Constant time is not claimed as a whole-library property. The three timing channels found in encryption are closed: two are guarded by tests that measure a slope against the secret, and the third — the cache address — cannot be, because it changes neither the answer nor the time measurably; it is guarded by a check on the shape of the code. Key generation is a prime search and is not constant time at all.

Both are explained in full, with the measurements, in the documentation.

Numbers

2048-bit key, medians:

Reproduce with python benches/measure.py.

Accuracy

Fixed point, rounding to nearest. The scale is configurable and travels inside the ciphertext, so decryption reads it from there and addition refuses a batch that mixes scales:

blobs = paillier.encrypt_many(pub, values, scale_pow10=12)

The default is 10^8. See Encoding and scale.

Where a float is not good enough, nothing has to pass through one: encrypt_integers and multiply_integers take Python ints of any size the key admits, decrypt_exact_many returns (numerator, pow10) at any scale without dividing, and the float paths take a named rounding rule — rounding="half_even", exact=True — with today's as the default.

Building from source

pip install maturin
maturin build --release

Needs stable Rust. GMP is built and linked statically.

Licences

The sources are MIT OR Apache-2.0, at your option.

The built wheels additionally contain GMP, statically linked through rug, and therefore fall under LGPL-3.0+ as a whole. For a binary with no LGPL code inside, build from the source distribution against your own GMP: pip install --no-binary pypaillier pypaillier.

Full breakdown, including how the LGPL §4 conditions are met: NOTICE.md.