garble-lang VS zk-paillier

MPC has in the past been mostly confined to academia, but thanks to some recent papers has finally become fast enough for practical applications. Internally, Tandem uses Garbled Circuits, encrypted circuits consisting of boolean gates. While there have been other implementations based on these ideas, Tandem tries to provide a much better user experience than previous attempts. For example, the Tandem repo includes a server, a command line client and client libs for wasm and native architectures. To make it easier to run practical applications, programs can be written in Garble, a custom Rust-like programming language that compiles to Garbled Circuits.

- https://github.com/ZenGo-X/zk-paillier

I am not aware of a more direct approach for proving the equivalence. One might consider looking to see if there is a Sigma protocol that can prove the equivalence, as that might lead to a proof with faster proving time. There exist Sigma protocols for proving knowledge of plaintext for each of those encryption systems. For RSA, proving knowledge of m where C1 = m^e mod n can be done using the GQ protocol (see Boneh-Shoup, Sec 19.5.5). For Paillier, proving knowledge of m, R where C2 = g^m R^n mod n^2 can be done using the protocol of CDN (see CDN, Sec 9.1.2 and impl).