| Input: Alice privately holds a -bit binary string , and Bob holds a private -bit binary string |
| and the public key pair () of Paillier encryption scheme where and are public key and private key, respectively. |
| Output: Alice obtains where , and Bob learns nothing. |
| 1: Alice generates two random -dimension vectors . For each , let and denote the -th dimension of |
| and , respectively. |
| 2: Alice computes two -dimension binary vectors such that their -th bits and satisfy if , |
| otherwise . if , otherwise . Alice sends and to Bob. |
| 3: Alice computes and . Then, Alice utilizes bits to represent , , respectively. The first bit |
| denotes the sign where denotes positive and denotes negative, and the latter bits represents the their absolute value. |
| Let . We use to denote the bits of and , in which the first |
| bits correspond to , and the latter bits correspond to . |
| 4: Bob computes and . Then, Bob utilizes bits to represent , , respectively. |
| The first bit denotes the sign where denotes positive and denotes negative, and the latter bits represents the their |
| absolute value. Similarly, is used to denote the bits of and , in which the first |
| bits correspond to , and the latter bits correspond to . |
| 5: For to , Bob uses his public key to encrypt each private bit , and sends to Alice. |
| 6: Alice computes encrypted Hamming distance , where if and |
| if . |
| 7: Alice and Bob select a -degree public Lagrange interpolation polynomial in which is the large integer |
| in the public key, such that satisfies . Namely, we can correctly attain the output by |
| setting , since . |
| 8: Alice sets , i.e. , and where and is randomly selected from . After |
| that, Alice sends to Bob. |
| 9: Bob decrypts , encrypts , and returns the ciphertext to Alice for . |
| 10: Alice computes , and further gains the final output |
