The Damgård–Jurik cryptosystem[1] is a generalization of the Paillier cryptosystem.
It uses computations modulo
is an RSA modulus and
a (positive) natural number.
Paillier's scheme is the special case with
(Euler's totient function) of
can be written as the direct product of
is cyclic and of order
For encryption, the message is transformed into the corresponding coset of the factor group
and the security of the scheme relies on the difficulty of distinguishing random elements in different cosets of
It is semantically secure if it is hard to decide if two given elements are in the same coset.
Like Paillier, the security of Damgård–Jurik can be proven under the decisional composite residuosity assumption.
At the cost of no longer containing the classical Paillier cryptosystem as an instance, Damgård–Jurik can be simplified in the following way: In this case decryption produces
Using recursive Paillier decryption this gives us directly the plaintext m.