Paillier Private $\mu$ and $\lambda$ The Paillier CryptoSystem has a public key that $(g,n)$ and the private key which can be exclusive to $\lambda$, where the decryption scheme is:

$m = L(c^\lambda \bmod n^2)/L(g^\lambda \bmod n^2) \bmod n$

Since $1/L(g^\lambda \bmod n^2)$ is fixed and always needed for decryption, it is usually computed once and denoted as $\mu$.

What information does $\mu$ leaks about $\lambda$? Because at the end of the day, even if I have $\mu$, I cannot decrypt. i.e. Can I get $\lambda$ from $\mu$?



A Side Note on the way $\mu$ is constructed, that I think proves the correctness of the assumption:

\begin{align}
    g &amp;= (1+n)^\alpha \cdot \mathcal{B}^n \pmod{n^2} &amp; &amp; \text{$g$ in the $n^{\text{th}}$ root form} \\
    g^\lambda &amp;= (1+n)^{\alpha\lambda} \cdot \mathcal{B}^{n\lambda} \pmod{n^2} &amp; &amp;\text{so base on carmichael's theorem} \\
    g^\lambda &amp;= (1+n)^{\alpha\lambda} \pmod{n^2} &amp; &amp; \text{again, based on $n^{\text{th}}$ root rule}\\
    g^\lambda &amp;= 1+n\alpha\lambda \pmod{n^2}&amp;  &amp; \\
    L(g^\lambda) &amp;= \alpha\lambda \pmod{n^2}&amp;  &amp;\\
\mu &amp;= 1/\alpha\lambda \pmod{n^2} &amp;
  \end{align}
So, since it is impossible to get $\alpha$ given $g$, the main complexity of the encryption scheme itself, and the last equation is a function of two variable, and there is no way to find either variable.
What information does $\mu$ leak about $\lambda$?


The safe assumption is: all. It must be assumed that knowledge of $\mu$, together with the public key, allows computing $\lambda$ (which allows decryption and factorization of $n$).

At least, that holds in Paillier's scheme as described in Jonathan Katz and Yehuda Lindell's Introduction to Modern Cryptography (section 13.2.2). In this we have $p$ and $q$ of equal size, $g=n+1$, $\lambda=(p-1)(q-1)$, and $\mu=\lambda^{-1}\bmod n$. It follows that $\lambda=\mu^{-1}\bmod n$, allowing computation of $\lambda$ from $\mu$ and $n$ (using e.g. the extended Euclidean algorithm, which is inexpensive).

While that does not immediately tell how to compute $\lambda$ from $\mu$ and $n$ in Paillier's scheme as in the question, that's enough to show that we can't safely reveal $\mu$.