Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to implement the Efficient Robust Private Set Intersection using Additive ElGamal.

For this, from the client side, my inputs are $C = \{1, 2\}$. So, the polynomial is $(x-1)(x-2)$ which is $x^2-3x+2$.

The next step is to encrypt the variable coefficients which are $1$, $-3$, $2$.

Can someone tell me how to use ElGamal for encrypting negative numbers. If there is an example which one can run from Client and Server side, it will be really helpful.

share|improve this question
Dr. Lecter, My question is more on the front if the coefficients of the resulting polynomial can be negative when (x-1)(x-2) is computed over a finite field? If not, I would like to know how to compute the product of the above polynomials? – user11706 Feb 17 '14 at 14:41
up vote 2 down vote accepted

I use the notation introduced in the paper: The parameters of ElGamal are $(G, q, g)$ where $q$ is prime, $G$ is a cyclic group of order $q$ and $g$ is a generator. In the paper, the authors use "exponential ElGamal" such that they have an additive homomorphism, i.e., the message is represented as "exponent" of $g$, i.e., as $g^m$. With $h=g^x$ being the public key a ciphertext of a message $m\in Z_q$ is $(c_1,c_2)=(g^y,h^y\cdot g^m)$ and it is clear that by componentwise multiplication of two ciphertexts for messages $m_1$ and $m_2$, the additive homomorphism gives a ciphertext for $m_1+m_2 \mod q$.

Note that the message space is $Z_q$ and we are working with integers modulo $q$, i.e., the set $\{0,\ldots,q-1\}$.

Now how to handle negative integers $-x$?

There are two ways how you can see this:

If for $-x$ that the absolute value of $x$ is in the set $\{0,\ldots,q-1\}$, i.e., you have that $0\leq |x|<q$. Then, you can view $-x$ as the additive inverse of $x$ in the group $(Z_q,+)$ which has order $q$. This means $-x$ is an element $a$ for which it holds that $x+a\equiv 0 \pmod q$. Consequently, the value of $a$ is $p-x$. For example: Let $q=5$ and we want to know $-2$, i.e., the additive inverse of $2$ in $Z_5$, then we have $-2=5-2=3$, since $2+3\equiv 0 \pmod 5$, so $-2$ is equal to $3$.

Now what if the absolute value of $x$ is not in the set $\{0,\ldots,q-1\}$? For instance, how to handle $-16$ in case of the integers modulo $5$?.

We also can view integers modulo $q$, i.e., the set $\{0,\ldots,q-1\}$, as a set of representatives of the $q$ residue classes modulo $q$. More precisely, $0$ is a representative for the class $[0]$ of all integers having remainder $0$ when divided by $q$, $1$ a representative for class $[1]$, etc. If you encounter a negative integer as defined above, then you simply add $q$ until the value lies within the set $\{0,\ldots,q-1\}$ since this will obviously not change the class.

Back to our example, this means that given $-16$ you add $5$ and find that $-16+5=-11$, $-11+5=-6$, $-6+5=-1$ and finally, $-1+5=4$. Consequently $-16\equiv 4 \pmod 5$ and you can represent $-16$ as $4$.

share|improve this answer
Thanks Dr. Lecter for your response. It really helped me understand how to work on negative numbers. – Sunil Jan 26 '14 at 23:16

The coefficients in the polynomial are elements of the field; when you expand the polynomial:


where $1$ and $2$ are field elements, the normal algebraic rules apply (because those rules are based on the field properties), you get:

$$x^2 + -(1+2)x + (1\times2)$$

where the middle coefficient is the additive inverse of the sum of 1 and 2 (computing both the addition and the additive inverse using the field operations)

Is the field element $-(1+2)$ negative? Well, in a finite field, saying whether a specific element is negative doesn't make a great deal of sense, however I believe that answers your question.

share|improve this answer
Moderator note: This answer was migrated from a merged duplicate question. – Paŭlo Ebermann Feb 21 '14 at 21:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.